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1 PROCE 


2 THE CLERK: All rise. 


3 (Court enters.) 


4 THE COURT: Everyone may be seated. The last juror 


5 just arrived. I have handed out a complete version -—- almost 


6 complete version of the jury instructions. There was a 


7 suggestion for an edit made by the defense, which I'm told the 


8 government agreed to, which I will incorporate, but it's not in 


9 that draft that you just got. It involves the word "entirely." 


09:10 10 So I will do that orally. 


11 I think at this point, unless there's anything else -—- 
12 you're about an hour and a half; is that right? 


13 MR. KOSTO: A little less. 


14 THE COURT: Okay. Well, at about an hour anda half 


15 ['ll give you the —- sort of the "eh," you Know, because we 


16 have to just get this going. People can't listen after a 


17 certain point. We'll take a break after the openings so that 


18 they're fresh when they come in and hear you. How long do you 


19 think you'll be? 


09:10 20 MR. NEMTSEV: 45 minutes to an hour. 


21 THE COURT: Okay. And we'll take either a break or 


22 lunch and we'll go into my charge, which I think is actually 


23 quite long. 


24 MR. FRANK: Judge, you forgot my rebuttal again. 


25 THE COURT: I keep forgetting your rebuttal. Yes, 
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1 your rebuttal, and then we'll go into the charge. 


2 Okay. There we go. I think we'll bring the jury in. 


3 MR. FRANK: So we'll go straight into the rebuttal 


4 after the defense? 


5 THE COURT: If it's only 45 minutes, yeah. I do 


6 usually make a practice of handing out the verdict form for the 


7 jurors so they know what counts that you're addressing. So 


8 T'll give this now to MaryEllen. Do we have a form of 


9 indictment? We don't have to deal with that right now. I'm 


09:11 10 not going to give that to anyone right now, but do we have it 


11 here in the courtroom, the indictment everyone agreed on? 


12 MR. FRANK: We do not, but we'll get it during the 


13 It's just the —-- 
14 THE CLERK: Just one minute -—- 


15 THE COURT: Oh. Never mind. Then we won't hand it 


16 ; It's not essential. 


17 THE CLERK: They can run up and get a copy. 


18 THE COURT: I know, but we're not waiting for it. 


19 MR. FRANK: We had agreed to just put in the counts. 


09:11 20 Did we agree to leave it out entirely? 


21 (Discussion held off the record.) 


22 MR. FRANK: So we'll just put in the counts, Your 


23 
24 THE COURT: Excuse me? 


25 MR. FRANK: The parties have agreed to just send back 


09:13 10 
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Yes, on the indictment. Yes, yes. 


All rise for the jury. 


Good morning to everyone. Anyone speak 


see anything in the press, social media, anyone 


try and get in touch with you? Okay. Good. We're going to 


hand out right now a blank, obviously, verdict form. These are 


all so that you understand the counts that will be addressed in 


the closing arguments. Obviously, at the end of the case, 


we'll only want one official form, but you can take notes on 


this if you choose to. The verdict form needs to be unanimous. 


We'll first hear the government's closing. Remember, 


it's not evidence. 


sum up the evidence. 


full-blown break. 


It's just the government's opportunity to 


Then we'll take a brief break, not a 


And then we'll go to defense closing 


argument. Then there'll be a brief opportunity for rebuttal 


and then we'll take a break, and then it will be the closing 


instructions that 


09:13 20 


21 


22 


23 


24 


25 


this case. 


MR. 


F 


KERN 


CH: 


THE COURT: 


MR. 


7 


KERN 


CH: 


T'll give you about the law that applies in 


It's going to be a long day. We'll feed you well. 


But we're going to get going right now. I'm not sure what's 


that -—- what's over there. 


Just one of the chalks, Your Honor. 


That we've already seen? 


Yes. 
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il THE COURT: Fine. Good. Okay. Have you shown to 


2 them what it is? Because it's not visible from here. 


3 MR. FRANK: It's the same chalks we've been using with 
4 the photographs. 


5 THE COURT: Okay. Good. Let's be seated. Let's get 


6 If you're taking notes, please mark down this is -- 


7 MR. FERNICH: May it please the Court? 


8 THE COURT: Yes. 


9 MR. FERNICH: Counsel. 


09:14 10 [ING ARGUMENT BY MR. KOSTO: 


Li MR. KOSTO: Good morning. The defendant, Vladislav 


12 Klyushin, the owner of a company that advertised its ability to 


13 hack into computer networks at will, opened a brokerage account 


14 for the first time in July 2018. Even though he was a beginner 


LS at trading, he quickly made nearly 21 million dollars betting 


16 on earnings announcements, an almost 900 percent return. The 
17 stock market's return for that same period was only 25 percent. 


18 The defendant also traded on behalf of three 


19 investors Alexander "Sasha" Borodaev, Boris Varshavsky, and 


09:15 20 Sergey Uryadov -- making another 23 million for them in even 


21 less time, and taking a cut of as much as 60 percent of that 


22 money for himself. 


23 One of the defendant's employees involved in this 


24 trading, Nikolai Rumiantcev, made millions more, even though he 


£ 


25 had never had a brokerage account before either. Two other 
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A associates, Igor Sladkov, the guy with the M-13 chat app in his 


2 iCloud account, and Mikhail Irzak, took home 50 million. They 


3 were connected to the defendant through his friend and employee 


4 van Ermakov. For this whole group, a cool 90 million dollars. 


5 But here's the thing: The defendant was a one-trick 


6 pony. He and his crew were good at only one thing. Somehow 


- they only managed to make money on quarterly earnings 


8 announcements, and not just any quarterly earnings 


9 announcements, they traded the earnings of companies that filed 


09:17 10 their earnings reports using one of two filing agents, 


11 Donnelley Financial and Toppan Merrill, two companies that, it 


12 just so happens, were hacked at the exact time that the 


13 defendant and his crew started making money hand over fist. 


14 But as it turns out, the defendant wasn't even a 
LS one-trick pony, because in January 2020 when TM reset its 


16 passwords and kicked the hackers out, the defendant basically 


17 stopped trading earnings in companies that filed their reports 


18 through TM, and he stopped making money on it. And in August 


19 2020, when DFIN got the hackers out of its network, the 


09:17 20 defendant and his crew all but abandoned ship on trading 


21 earnings. When they didn't have tomorrow's news today, they 
22 went from trading earnings 78 percent of the time to less than 
23 7 -- or barely 7 percent of the time. And their win rate 

24 dropped from 68 percent to 42 percent. Now they were getting 


25 earnings calls wrong more often than they were getting them 
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A right. And they started losing money on earnings trades. 
2 Now that you've seen and heard the evidence, you know 


3 why. The defendant and his associates were trading on stolen 


4 information, information they obtained by hacking into DFIN and 


5 TM's computer networks using the same techniques that the 


6 defendant advertised to his cyber security clients. At the 


i beginning of this case, we told you that the evidence would 


8 prove beyond a reasonable doubt that the defendant did exactly 


9 what he's charged with doing, scheming with Ivan Ermakov, 


09:19 10 Nikolai Rumiantcev, and others to hack into Internet-—connected 


11 computers, to steal information from those computers, and to 


12 use that information to make money by trading stocks for 
13 themselves and M-13's clients. 
14 You know now that the evidence has shown exactly that. 


15 For his actions, the defendant is charged with four crimes: 


£ 


16 Wire fraud, securities fraud, unauthorized access to computers, 


£ 


17 and conspiracy to commit those crimes. Over the next hour or 


18 so, I'm going to walk you through the evidence of these crimes 


19 in four basic parts. First, that TM and DFIN were hacked. 


09:20 20 Second, that the defendant, his co-conspirators, and his 


21 company, M-13, were behind those hacks. Third, that the 


22 confidential information that they stole from TM and DFIN 


23 related to their purchase and sale of securities. And fourth, 


24 that from the moment Vladislav Klyushin joined this conspiracy, 


25 he was all in. He knew what he was doing was wrong. 
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alt So let's start with the hack. There's no serious 


2 dispute in this case that the filing agents, DFIN and TM, were 


3 hacked. The hackers used the Internet to download the 


4 confidential business information belonging to TM and DFIN's 


5 publicly traded clients. Every employee who testified told you 


6 that both the companies kept the information confidentially 


7 online and under digital lock and key with usernames and 


8 passwords. Of course they did. This was information that the 
9 public didn't have yet. This was tomorrow's headlines. Julie 
09:21 10 Soma called it confidential and sacred. Hyeyoung Han told you 


‘lal employees couldn't trade on this because it was inside 


12 information, information that could affect the price of the 


13 client company's stock when it was released, information that 


14 these clients hadn't yet filed with the SEC's EDGAR system. 


15 This was also a sophisticated and coordinated hack. 


16 But even so, the hackers left a trail for you to follow. These 


17 attacks both hit at the same time, February 2018 or a little 


18 bit earlier for DFIN. And later the same year for TM. You 


19 remember the testimony about DirBuster hitting those computers 


09:22 20 every second in November of 2018. 


21 There were similar IP addresses that hit both 


22 companies, like ones from AirVPN, assigned IP addresses 


23 starting with 199.249.230 on your screen from Julie Soma's DFIN 


24 account and Arthur Smallman's account at Toppan Merrill. These 


25 weren't the VPNs that companies offered their employees to get 
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1 online. These were commercial VPNs that helped the hackers 


2 hide their location. 


3 There were other IPs common to both victims too, 


4 including one you'll recognize, 89.238.166.235. The hackers 


5 harvested the same kinds of information from both companies, 


6 earnings reports filed with the SEC in those forms, 10-K, 10-Q, 


7 8-K, and the exhibits, like Exhibit 99.1, all taken shortly 


8 before they were to be filed. 


9 Just from the Boston IP address alone, 104.238.37, 


09:23 10 there were 113 different downloads in over three weeks, and you 


Li saw when Ms. Yanochko testified, all in, basically, 


12 alphabetical order, between 1:00 a.m. and 7:00 a.m. on the lef 


13 of Exhibit 195 there. That just so happened to be in the 


14 middle of the business day in Moscow. Ms. Han from Korea, she 


15 idn't even deal in Exhibit 99s, and her downloads also came 


16 when she was sleeping, but in the middle of the Moscow 
17 afternoon. Pacific time on the left, Moscow time on the right. 


18 And you know that the downloads over Jason Lewis's accounts 


19 weren't his. You know that DFIN salesmen didn't even access 


09:24 20 live data. The hackers burned through his credentials after 


21 DFIN reset Ms. Soma's credentials and then reset Ms. Han's 


22 credentials in April of 2020. There he is in purple on that 


23 bar graph in May 2020. 


24 The FBI caught a real break with these logs. The logs 


25 didn't capture every single download that took place, but the 


09:25 1 


09:26 20 
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his user log from Toppa 
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certainly didn't use it 
at in the middl 


a time, 


computer that had the w 


same kind of malware found at both companies, 
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he hackers were up to. TM, for its 


days of logs, but the ones they did 


Ben Oliver took one look at 


n Merrill. Remember, he shook his head 


Bridge system for his job, and he 


like that, 


opening file after file, one 


e of the night, Pacific time, over a 


USLEDGE. 


rong name, And there was the 
tools to steal 


tools to make secure 


usernames and passwords 


connections between computers, 


to hide i 


tself on those 


DF 


IN's inciden 


£ 


one of the pieces of ma 


like Mimikatz, 


like PowerShell, malware renamed 


victim companies' networks. 


t response professional told you that 


lware on DFIN's network was so 


sophisticated that it was programmed to delete its own logs so 


they couldn't be found. 


companies phoned home in the exact same way, 


es 


auditsolutions from 


21 


22 


23 


24 


25 


You saw the pa 


did -- and I'll admit i 


tracing these attacks back to M-13's computer network, 


de 


fendant, and 


puters reached out to 


DEI 


t was painful 


to his co-conspirators. 


And the victims' computers at both 


both companies' 


Internet domains with bi 


zarre-sounding 


like cloudapifinance.info for TM or investmentcomp.com or 


N. These were the digital clues that 


led to the defendant's doorstep. 


tient and painstaking work that the FBI 


for all of us at times 


to the 


Painstaking because 
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ac these were sophisticated hackers, hackers that used the sam 


2 advanced hacking techniques that the defendant advertised on 


3 his company's website and in his pitches to clients. 


4 Exploitation of the most dangerous vulnerabilities in order to 


5 breach the network perimeter, obtaining credentials to access 


6 servers, identification of sensitive data stored in open form. 


7 And remember how sophisticated those attacks were. They 


8 involved dozens of IP addresses, those private VPNs, domain 


9 accounts rented by the dozen, each from a separate email 


09:27 10 address. Bitcoin to pay for them. Hacker computers protected 


11 by gatekeeping software. Malware renamed so that IT folks at 


12 the companies wouldn't spot it. PowerShell software that 


13 encrypted the communications between the victim computers and 


14 the hacker computers so that no one could see what was leaving 


15 the building. 


16 This is exactly what the defendant offered his 


17 customers. Our experts imitate a full-scale targeted attack 


18 during which the attacker, while trying to conceal his 


Soy 


19 presence, uses a wide range o 


actions against the 


09:28 20 organization's infrastructure. This is literally what the 


21 defendant did for a living. But despite that sophistication, 


22 you know that there's no such thing as a perfect crime. And 


23 you saw three different ways that the FBI was able to trace 


24 these hacks back to the defendant by following the clues in the 


25 digital evidence. 


09:30 10 
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all ten of those strange-sounding 


the malware at Toppan Merrill and 


the domain company. You saw the 


first name, last name, sometimes 


digits @inbox.lv. Nine of those ten domain accounts were 


accessed by a single IP address in yellow there, 


89.238.166.235. And you know 


that that was one of the same IP 


addresses that hit both DFIN and TM directly. 


AirVPN and other IP addresses from the hack in blue 


and green here had accessed Namecheap too. You learned that 


those Namecheap domains were assigned to Digital Ocean and 


Vultr, Internet companies that rented out those virtual servers 


through their resellers, BitLaunch for Digital Ocean and 


99Stack for Vultr. And you know that IP addresses used at 


09:30 20 


21 


22 


23 


24 


25 


BitLaunch were also some of the same IP addresses that hit 


Toppan Merrill. Exhibit 178 on your left is from BitLaunch's 


records, and Exhibit 77A on the right was the information from 


Toppan Merrill, blue to blue, 


And you saw the same 


hit both 99Stack, the Vultr reseller, and Toppan Merrill. 


yellow to yellow. 


kinds of common IP addresses that 


99Stack on the left, Toppan Merrill on the right, same IP 


addresses. Here's what else you know: Both the BitLaunch and 


the 99Stack virtual server accounts had the same subscriber, 


someone using the name Andrea 


Neumann and the email address 


neumann@dr.com. And the Neumann account at Vultr was accessed 
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al by that familiar IP address again, 89.238.166.235. 


2 You also know how those rented computers were used 


3 because the FBI forensic examiner told you. These were the 
4 hacking computers that hit TM. He found Mimikatz, the same 
5 password-stealing software that TM's consultant told you was 
6 found at TM. He found renamed PowerShell. Remember rdtevc? 


. That's the same software name that TM found on its computers. 


8 On the hacker computers, he found the names of TM computers, 


9 ike USD for U.S.desktop 10846, and TM employees that Ben 


09:32 10 Oliver told you about, Rayna Behm and Jerome Taylor. 


11 And he found evidence of that gatekeeper program, 


12 NGINX, which hid the hacker's command computer behind a 


13 protective shield of seven gateway computers so that anybody 


14 from TM who was looking into all this traffic leaving their 


15 network would be directed somewhere else. When they went 


16 looking for cloudapifinance, they would end up at a completely 


ay different website. They wouldn't be allowed through. 


18 And you know that from those hacker computers, the 


19 trail led right back to the defendant's company. Namecheap 


09:33 20 records showed that neumann@dr.com, the email that was used to 
21 rent the hacker servers, was also associated with another 
22 Namecheap account. This one too had been accessed by that 


23 familiar IP address, 89.238.166.235, that had attacked TM and 


24 DFIN and that was associated with so many of those other 


25 Namecheap accounts that you've seen already in this case. And 
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1 the Neumann account was paid with Bitcoin. 


2 You know from the FBI's cryptocurrency expert, whose 


3 testimony was virtually unchallenged, that the Bitcoin used to 


4 pay for the Neumann Namecheap account led right back to the 


5 defendant's company. First, the change from the Neumann 


6 transaction —- that's Namecheap domain 1 -—- went to Namecheap 


7 domain 2 under the name kavin.sspender@mail.com. And the 


£ 


8 change from kavin.sspender was used within just about two hours 


£ 


9 to pay for a third Namecheap account. That one was paid for 


09:34 10 and registered with an inbox.lv email address, 


11 wan-connie909@inbox.lv, just like all the Namecheap accounts 


12 that were used in the attack on DFIN and TM. You know from all 


13 this evidence that Namecheap accounts, Neumann, sspender, and 


14 Wan Connie were paid for and controlled by the same people. 


iS) And here's what else you know, that the Wan Connie 


16 account leads right back to M-13, right back to the defendant's 


17 company. You can see it right there in the BitPay records. 


18 This is Government Exhibit 181, Column S, 89.107.124.42. 


19 That's the M-13 IP address, the defendant's company, the one 


09:35 20 that tells its customers it can imitate the very same hacking 


21 technigues that were used on TM and DFIN, the same M-13 IP 


22 address that the defendant, Nikolai Rumiantcev, and Ivan 


23 Ermakov all used regularly. It's right there in the Namecheap 


24 records too. 89.107.124.42. 


25 But you know that's not the only connection between 
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al: M-13 and the hacks. There were all those AirVPN IPs that were 


2 used to hit both victims. You know the FBI got a pen register, 


i) that caller ID for computer connections, on one of those AirVPN 


4 IPs. That was the one that hit Benjamin Oliver's account at 
5 Toppan Merrill, 185 -- you can see it there —- .228.19.147. 


6 Exhibit 130 tells you this is an AirVPN IP address. Somewhat 


- unsurprisingly, there were dozens of hits on that caller ID 


8 from the 89 IP, 89.238.166.235, that familiar IP address that's 


9 all over these attacks, at Namecheap, at Digital Ocean, at 


09:36 10 ltr, at DFIN, at Toppan Merrill. 


11 And here's who else showed up using that exact same 


12 AirVPN IP, including on that same day, January 29th, 2020, the 


13 very first day that the FBI had its pen register up and 


14 running, the defendant's company, M-13. You know that there 


15 are a lot of VPN companies out there, and literally billions of 


16 IP addresses. The defendant's own witness, Mr. Roberts, told 


ay you so. It just so happens that the defendant's company chose 


18 this VPN provider, and not just this VPN provider, but this VPN 


19 provider's IP address that was used to attack TM. And here's 


09:37 20 what else you know. The defendant was at the office that day, 


21 because within an hour of the AirVPN computer hitting M-13's IP 


22 addresses, the defendant was logging into his Russian Standard 


23 Bank account from the very same IP address. 


24 van Ermakov was no stranger to AirVPN either. 


25 Despite all of the VPNs out there and the 3.7 billion 
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i addresses, he'd been using that same AirVPN IP to update his 


2 iTunes account for years. Members of the jury, that's no 
3 coincidence. That is a mistake that led you right to him. 


4 The M-13 IP addresses here at Government's Exhibit 186 


5 and 187 were totally wrapped up in this hack-to-trade scheme. 


6 They came back to Namecheap. They came back to AirVPN. And 


7 the defendant, Rumiantcev, and Ermakov used that same IP in 


8 their own names all but daily. In fact, it was the M-13 IP 


9 address that Ermakov used to download the SaxoTraderGO app, the 
09:38 10 one he used to trade in the defendant's Saxo accounts. They 
11 used the M-13 account to access WhatsApp, Facebook, Apple. 


12 They also used it to access Rumiantcev's trading accounts, the 


13 defendant's trading accounts, and the trading accounts of those 
14 three investors, Alexander Borodaev, Boris Varshavsky, and 


LS Sergey Uryadov, which tells you who was managing the investors' 


16 accounts, by the way, the same accounts that engaged in all o! 


17 the suspicious trading. 


18 It's no accident that the defendant and his associates 


19 used AirVPN because you know that they were obsessed with 


09:39 20 anonymity, just as you would expect hackers to be. That's why 


21 they used encrypted apps like WhatsApp. And even more secure, 


22 Threema chat, and eventually a completely impregnable chat that 


23 M-13 built for itself, that even the defendant's own expert, 


24 Mr. Roberts, couldn't read. It was their own hidemyass.com. 


25 The third forensic connection to M-13 was another 
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1 Ermakov mistake. You know that Ermakov connected to Apple to 


2 update his iTunes account, in his own name, over the IP address 


3 194.204.194.11 three times at about 7:44 in the morning, Zulu, 


4 on May 9th, 2018. The IP address number itself isn't so 


5 important, but you know that four minutes later, that same IP 


6 was used to attack DFIN over Julie Soma's account in the middle 


7 of the night on the West Coast of the United States. Ivan 


8 Ermakov might as well have signed his name in DFIN's logs. And 


9 here's what else you know. The defendant actually did sign his 
09:41 10 name to this crime, because you know what you can't do 


‘lal anonymously? You can't buy and sell stocks. And this is how 


£ 


12 you know to a certainty that the defendant was involved in this 


13 scheme. 


14 In fact, you could convict the defendant based on his 


LS trading activity alone. For starters, you have to remember who 


16 the defendant and these other traders were. He didn't even 


17 have a brokerage account before July 2018. Neither did 


18 Mr. Rumiantcev, neither did M-13, neither did Mr. Irzak or any 


19 of the investors. The defendant told Saxo Bank that M-13 had 


09:42 20 ten years of analytics experience. But here's what he didn't 


21 say: He didn't tell the bank he'd only been trading since July 
22 2018. These men, this group, they were stock-trading nobodies. 


23 Take a look at M-13's website when you get back to the 


24 jury room, Exhibits 60 through 64A, they're there in 


25 translation for you. You'll find a lot of information about 
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1 hacking. You will not see one word about trading. And then 


2 all of a sudden, just as DFIN and TM get hacked, the defendant 


3 became the G.O.A.T. of earnings trading, the greatest of all 


4 time. And here's what else you know. The defendant may not 


5 have joined the scheme until mid-2018, a few months after i 


6 started with Sladkov and Irzak, but once he was in, he was very 


7 much in charge, telling Ermakov and Rumiantcev exactly what to 
8 do. He didn't do the day-to-day trading, but you'll see that 


9 he was very much in the weeds. One way you know that is from 


09:43 10 the way he took charge in that Saxo Bank meeting in April of 


dad. 2020. You remember the call where the bank wanted answers to 


12 questions about the defendant's suspicious trading. Jeffrey 


13 Zorek told you about it. There's a name from a while ago. 


14 Listen to the second half of that call. There's a 


15 moment where Rumiantcev can't handle the most simple question. 


16 I have simply almost no recollection of this. I don't 


17 remember that situation." And it's the defendant who jumps in 


18 to answer Mr. Zorek's questions about trading, the strategy 


19 behind it, and the specifics of the trades they made. The 


09:44 20 defendant recited those details o 


the tip of his tongu 


21 the date of the Tesla trade, the price, the amount of th 


22 trade, when it was in relation to the earnings report, h 


23 stock reacted. Over and over in that meeting, the defen 


24 demonstrated an almost encyclopedic knowledge of his own 


25 trading in Ulta, in Roku, in Tesla. Look at the transcript. 


09:45 10 
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And you know from the supersecret Threema chat that he was a 


demanding boss. 


When Ermakov traded both long and shor 


stock, the defendant immediately asked to clari 


= 


Situation. Later, a year before that Saxo call 


t in the same 


fy the 


, the defendant 


was demanding to know what went wrong with a single trade. 


Vlad has to tell him what happened to the Grub. 


screwed it up. And when Ermakov and Rumiantcev 


trading, the boss needed to know. "Vlad needs 
which date and to which date we do not trade." 


When Ermakov and Rumiantcev talked abo 


Ermakov had 


weren't 


informa 


ut hiring a 


trusted analyst -- and these are the reports that the defendant 


was asking after -- when Ermakov and Rumiantcev 


hiring a trusted analyst they could use to help 


revealing their secrets, Rumiantcev said he wou 


09:46 20 


21 


22 


23 


24 


25 


estimate the cost and write to the defendant be 


make the hire. And you saw what happened when 


talked about 


them without 
ld need to 


£ 


fore they could 


Ermakov wanted 


to add someone else to the secret chat, a colleague, Ermakov 


said, who was completely on top of the subject. 


"You can trust 


him as you trust me." But that wasn't good enough for 


Rumiantcev. He wanted to make sure that the de 


given the okay. And in May 2019, the defendant 


Threema chat so that Ermakov and Rumiantcev wou 


fendant had 
joined the 


ldn't have to 


keep going to him with all their questions and updating him. 


They could all just discuss the trading togethe 


r in one place. 


09:47 10 
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He'll be reading it on his own. And look at how he traded. 


Max Clarke from the SEC told you there were about 


38,000 earnings filings the defendant could have traded on 


between July 2018 and September 2020. DFIN and TM handled 


about 16,800 these, or 44 percent. Given that market share, if 


the defendant's trading were unrelated to who the 


filing agent 


was, you would expect him -- you would expect to see him 


trading in DFIN and TM only about 44 percent of the time. 


Instead, the defendant traded in the earnings of 


DF 


IN and TM 


clients 96 percent of the time, 343 out of the 356 trades he 


lips. No trading strategy would yield choices 


09:48 20 


21 


22 


23 


other than a trading strategy based on who the fil 


was. 


made during that period. Mr. Clarke told you that that was 
like flipping a coin 356 times and getting heads on 343 of the 
like that, 


ing agent 


And you know that makes no sense. These companies 


aren't doing anything that affects the company's stock price. 


They're service companies. They format earnings filings, and 


they ship them off to the SEC, just like FedEx and DHL deliver 


packages. You don't pick stocks based on who the filing agent 


is either. There's really no dispute about that 


in 


this case, 


but Mr. Clarke's statistical analysis said that if there was no 


£ 


relationship between the filing agent and the def 


24 


25 


time in a trillion. In a trillion. 


endant's 


trading choices, you would see trading like this less than one 
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1 But here's how you know to a certainty that the 


2 defendant's trading was based on the hacks at DFIN and TM, 


3 because when he and his fellow hackers were locked out of those 


4 companies, they stopped making money, and they stopped trading 


5 earnings releases, going from trading earnings about three 
6 quarters of the time to just about 7 percent of the time. You 
7 didn't leave your common sense at the door to this courthouse 


8 when you came in to serve as jurors, and your common sense 


9 tells you what that means. The hacks were the defendant's 


09:49 10 secret sauce. The stolen information was the key to his 

11 trading success, not that ridiculous app he described on the 
12 call with Saxo. 

13 You remember that. They called it Preston. He 


14 claimed it could review social and mass media and spit out 


is) stock recommendations, the same cover story that Rumiantcev and 


16 Ermakov discussed when they were thinking about that analyst 


17 that they wanted to hire. And remember how Rumiantcev react 


18 when his boss offered to let Saxo try this app out? He 


19 panicked. He got tongue-tied. He told Saxo it wasn't ready. 
09:50 20 Well, one would have to understand that the Preston app's 


2] primarily based on news. There is no financial information 


22 there. This is all about company image built on mass and 


23 social media. That's all. 


24 The defendant jumped in and insisted, and when Saxo 


25 did get its hands on Preston a few months later, the bank 
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1 didn't see any stock recommendations. And when it asked to see 
2 how the app recommended those stocks, Rumiantcev claimed that 
3 part was a trade secret. How could an app that was barely 


4 ready in July of 2020 be helping make stock picks all the way 


5 back to July of 2018? 


6 Mr. Clarke also showed you that the defendant and his 


7 traders had the most uncanny ability to predict market 


8 surprises, those times when analysts expected a strong earnings 


9 number, but the company underperformed, what Mr. Clarke called 


09:51 10 amiss. Or where analysts expected weak earnings, and the 
11 company's numbers turned out to be really strong, that was the 
12 beat. Whether earnings would be a miss or a beat was 


13 confidential. That's what was sitting on the servers at DFIN 


14 and TM. That's what made them surprises to the stock market. 


15 The biggest surprises were the outcomes that should have been 


16 the least predictable. But big surprises were what the 


17 defendant and his trading partners seemed to do best. 86 


18 percent of the time -- and that's on the right in Exhibit 


19 210 when there was a big and good-news surprise sitting on 


09:52 20 DFIN or TM's servers, the defendant bet the stock would go up. 


21 And when the surprise was disappointing, he consistently, 85 


22 percent of the time, went short, betting the stock would go 
23 down. But you know these weren't bets at all, because the 
24 defendant already knew the answers. 


25 Mr. Clarke told you that if there was truly no 
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] relationship between surprise information being stored at DFIN 


2 and TM, and the defendant's pattern of trading in the direction 


3 of that surprise, you'd see this trading less than one time in 
4 a trillion. 

5 Take a look at Skechers in the second quarter of 2019. 
6 That surprise was positive. The company was going to beat 

7 earnings by about 15 cents per share, 34 and 49, you have it 


8 there. All the traders, starting with Sladkov, started buying 


9 Skechers, betting the price would go up. And when the releas 


09:53 10 came out, that big black bar, the whole group, including the 


11 defendant, made more than a million dollars on that single 
12 trade. 


13 Kohl's, in the third quarter of 2019, was a big miss. 


14 The company missed its number by about 12 cents a share. But 


£ 


15 bad news for Kohl's was good news for the defendant and his 


16 co-conspirators. Following a download from DFIN's servers, he 
17 had jumped into the market in a short position, betting the 


18 price would go down. Here, again, the defendant in that third 


19 row made more than $600,000 predicting the most unpredictable 


09:54 20 of surprises. It happened again with Ulta Beauty. Ulta was a 


21 T client, so there are fewer logs here to show you. The 


22 earnings were a miss, and what's worse, the company's Exhibit 


23 99.1 updated its financial guidance downward, how much money 


24 the company was expecting to take in. Ulta's price plummeted 


25 by 30 percent when that news came out. But aman who was brand 
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aL new to securities trading, who had no brokerage account until 


2 July 2018, bet the price would go down, and he made almost 
3 2 million dollars overnight on a single trade. 


4 Now, you've also heard of examples on trades where the 


5 defendant lost money, and we showed you several. You also know 


6 why. Having earnings information ahead of everybody else is 


7 absolutely a huge advantage, an unfair advantage, but it 


8 doesn't guarantee success a hundred percent of the time. 
9 Mr. Clarke told you that. Sometimes the market reacts in 
09:55 10 unexpected ways. Sometimes companies announce other news, like 


‘lal that guidance from Ulta or the issuance of additional stock. 


12 That can offset even a really good earnings number. And 


13 sometimes the defendant and his associates simply didn't know 


14 what to make of the reports that they had downloaded. And you 


15 know that from the Threema chat. Rumiantcev admitted to 


16 Ermakov in 2018 that the two implement poor trading ideas, that 


LS} they have low-level competencies as traders, and that they 


18 actually sucked at certain trading strategies. That's exactly 


19 why they wanted to hire an analyst to help them, because they 


09:56 20 needed someone who knew what they were doing, but they also 


21 needed to keep the analyst in the dark. And that's why they're 


22 talking about hiding the true source of the information by 


23 mixing in fake documents with the real information. 


24 Ermakov told Rumiantcev that he made mistakes buying 


25 and selling shares on the exact same time. Another time 
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1 Ermakov had to explain to the boss that he had made an 


2 erroneous trade in Grubhub. And once, Ermakov, in his own 
i) words, was upset that he F'd up 30 to 40 percent wins that this 


4 group could have had. 


5 There was also a lot of information to sift through. 


6 You saw how many downloads there were. There were 


7 approximately 2,300 from Ms. Soma's account alone. And in this 


8 chat, Ermakov estimates 200 to 300 potential choices, trading 


9 choices, per quarter, and not all of them would be surprises. 


09:57 10 Sometimes companies just meet earnings. They don't beat them, 


11 they don't miss them. And that's not a company it would make 


12 sense to place a bet on. There simply wasn't enough time to 


13 digest all this information, and that's another reason they 


14 needed to bring in an analyst to help them out, to get through 


15 all the information that they were stealing. 


16 But bad as they were at trading, the defendant and his 


17 associates still managed to make astounding amounts of money. 


18 The defendant personally turned that 2.1 million dollars into 


19 21 million. He turned 4.5 million of his investors' money into 


09:58 20 25 million, and kept 60 percent of that for himself. You saw 


21 that at Exhibits 55, 56, and 57. These are the emails that 


22 Rumiantcev sent to the defendant updating him on what the 


23 investors were making and how much of that would stay with 


24 M-13. "Client receives 40 percent net profit." "Client 


25 receives 40 percent net profit." That's 60 percent right back 
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ac to the defendant. All told, with Irzak and Sladkov, these 


2 traders turned about 9 million dollars into 90 million dollars 


3 in a little over two years. 


4 And that brings us to Sladkov and Irzak and the 


5 devastating evidence that the FBI found on their computer 


6 screens. Pictures stored in Sladkov's iCloud account, the same 
7 account that had the M-13 chat app in it. Pictures that 


£ 


8 matched up word for word with the earnings releases those 


9 companies would later file. Take a look at Exhibit 24. This 


09:59 10 is Snap's information, the company that makes -—- or produces 


11 Snapchat. It's the laptop with the Russian Olympic Committee 


12 sticker, and that photo was taken on February 6th, 2018, at 


£ 


13 8:13 a.m. You know that information, the same information we 


14 did the bullet-by-bullet analysis -- we won't do it here -- 


15 wasn't filed until eight hours later, at 4:20 p.m. Sladkov and 


16 Irzak should not have had that picture when they did, and you 


A} now know where it came from. DFIN's consultant showed you the 


18 log, a download over Julie Soma's account, rr52260, on February 


19 5th, 2018, in the top left corner there, just one day earlier. 


10:00 20 Sladkov and Irzak did it again with an 8-K for the third 


21 quarter of 2018. 


22 For SS&C Technologies, another DFIN client, here's the 


23 SS&C data on Sladkov's laptop. It's in Exhibit 99. Agent 


24 Hitchcock told you the photo was dated 1:42 p.m. on October 


25 31st, 2018. Exhibit 82 is the 8-K and the Exhibit 99.1 that 
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1 SS&C actually filed with the SEC. That's a mouthful. It 


2 didn't go to the SEC, though, for another two and a half hours, 


3 at 4:13 p.m. Sladkov and Irzak should not have had that photo 


4 on their laptop either. But you know who traded this time? 


5 The defendant traded SS&C. And miracle of miracles, he bet the 


6 exact same way that Sladkov and Irzak did. The defendant 
7 didn't make any money on this deal, and you can see why in the 
8 Threema chat. 


9 On November 1, 2019, the day after Halloween, the day 


10:01 10 after that announcement, Ermakov reported to Rumiantcev, "SS&C 


‘lal is a problem stock." The men had missed that SS&C Technologies 


12 would be issuing more stock, something that would drive the 


13 company's share price down, even though the earnings 


14 information had been a beat. And you heard from Mr. Clarke 


15 that's exactly what happened. Ermakov thought SS&C was a 


16 problem stock because he had expected the stock to go the other 


17 way, because he had the earnings information that suggested it. 


18 He had that earnings information because Sladkov and Irzak had 


19 a picture of that 8-K before it was announced. And you know 


10:02 20 where this information came from, a download of an Exhibit 99.1 


21 over Julie Soma's account, from an IP address that came back to 


22 Boston, 104.238.37.195. 


23 Sladkov's companion, Olga, had a Tesla 8-K from 


24 October 19th, 2017. The 8-K that was publicly filed the next 


25 day on the right concerned entry into a material definitive 
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1 agreement. And here's what else you know. Sladkov and the 


2 defendant's right-hand guy, Ivan Ermakov, the one who traded 


3 the defendant's accounts using the SaxoTraderGO account, 


4 communicated about the defendant's trading -- about the 


5 defendant's stock trading. 


6 On May 20th, 2019, at 7:29 a.m. Eastern, while Julie 


7 Soma was still fast asleep on the West Coast, a hacker was 


8 using her credentials to take a 99.1 of Kohl's, the department 


9 store company. Mr. Clarke showed you that Sladkov and Irzak 


10:03 10 started selling short about two hours later, at 9:50 a.m. 


Li Rumiantcev started shorting 90 minutes later, and the defendant 


12 and the three investors, a little bit after that. By the time 


13 the market closed on May 20th, 2019, all eight traders, 


£ 


14 including the defendant, were betting that Kohl's would go 


15 down. Kohl's released its disappointing earnings the next day 


16 at 7:00 a.m. The store missed estimates by 7 cents, and the 


17 market did shoot down by about 12 percent. Bad news for 


£ 


18 Kohl's, good news for the defendant, for Sladkov, Irzak, and 


19 the others. That morning, after the news hit, the defendant 


10:04 20 bought the shares back at a low price and made himself a tidy 


21 $51,000 on his short position. Sladkov, Irzak, and the others 


22 who bet short along with the defendant made money too, 


23 including Rumiantcev, the employee, and the investors. And you 


24 know who else was communicating about Kohl's that day, sharing 


25 screenshots that were tracking Kohl's market price? Ivan 
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ac Ermakov and Igor Sladkov, the defendant's best buddy and the 


2 guy with the pictures of the confidential information on his 


i laptop. 


4 And that was far from the only connection between 


5 Sladkov and the defendant. Do you remember Avnet? Ermakov had 


6 this image of Defendant's SaxoTraderGO app on his iCloud 


£ 


7 account. It was an earnings miss, and ji 


you look at 


8 Exhibit 197B, all of the men started building their short 


9 positions, the beginning of the chart, at the same time. This 


10:05 10 was just a few days after a download of Avnet's information 


11 from an AirVPN IP address from TM. Over and over and over 


12 again, Sladkov, Irzak, the defendant, and his investors traded 


13 the same stocks, in the same direction, at the same time. They 


14 were in lockstep. 


15 Between 97 percent and 100 percent of the time they 


16 traded the same stocks, it was in the same direction. And you 
17 have Exhibit 255 here to show you. This is a chart showing all 


18 of the defendant's trading positions, short and long, on 


19 earnings events, compared to the other traders, including 


10:06 20 Saxo excuse me, including Sladkov and Irzak, who also traded 


21 at Saxo along with the defendant, with Rumiantcev, and the 


22 investors. When the defendant flips from green long to blue 


23 short, blue short to green long, so does everyone else. They 


24 all trade in the same direction together. That, members of the 


25 jury, is a plan. That is an agreement. 
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al And here's what else you know. On his iPhone, Sladkov 


2 had the defendant's superencrypted chat app, the M-13 chat app, 


3 so did Rumiantcev, and, of course, so did the defendant 


4 himself. That's the defendant's company. You can't just go 


5 the App Store and get it. Someone gave Sladkov access to tha 


6 encrypted app. Sladkov also had documents about an M-13 


7 product known as LAVR on his iCloud account, but he had it more 


8 than a year before that product was announced publicly. What 
9 was that product about that Mr. Sladkov had on his iCloud 
10:07 10 account? Not just any product, a hacking product about those 
11 RedTeam campaigns that the defendant was pitching to his 
12 clients. 


13 And if you look carefully back at Exhibit 255 on the 


14 top of your screen, you're going to see something interesting. 


15 Start at the bottom of page 1 of Exhibit 255 when you get back 


£ 


16 to the jury room, on October 24th, two from the bottom of the 


ay page, and read along. Capstead, Tesla, Snap, Apteo, Medpace, 


18 MGM Resorts International, McGrath Rental Corp., PJT Partners, 


19 Stifel Financial, Hess Corp., SS&C Technologies. Not only did 


10:08 20 the defendant trade those in the same way as Sladkov and Irzak, 


21 you will find a download over the Boston IP, 104.238.37, for 


22 every single one of those companies. 


23 And Judge Saris will instruct you that an Internet 


24 communication from one computer to another is a wire in 


25 interstate and foreign commerce. They were all there. The 
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al defendant, Sladkov, and Irzak were trading on the same 


2 information stolen over Julie Soma's account over a Boston IP 


3 address. And Mr. Clarke's statistics back up this same 


4 direction, same way, same time as well. He told you that 


5 nearly every time that the defendant, Sladkov, Irzak, M-13, 


6 Rumiantcev, and the investors traded on earnings, and there was 


7 a download from DFIN, the download came first. When there was 


8 trading with DFIN clients, it always came after a download from 


9 DFIN. And Mr. Clarke told you that if there was no 


10:09 10 relationship between those downloads and the defendant 


1] trading choices, you would not see a pattern like that 


12 download first, trade second more than a few times ina 


13 million. 


14 But you don't need a statistical expert to tell you 
15 that, because your common sense tells you the same thing. 


16 There is, in fact, a relationship between the downloads and the 


LS} trading, and you know what the relationship is. It was the 


18 downloads that caused the trading. It was the downloads that 


19 caused the defendant and his team to trade in the exact ways 


10:10 20 that they did. The hacks and the downloads were the secret 


21 sauce. 


22 Take a look at the Tesla earnings announcement for the 


23 second quarter of 2020. This is Exhibit 260B. The defendant, 


24 Sladkov, and M-13 were all originally short on July 22nd, 2020. 


25 That's at the left. They were betting the Tesla share price 
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i would go down. And suddenly, in the middle of the day, at 1:12 
2 in the afternoon on the 22nd, they reversed course. They 


3 started buying Tesla. What caused the defendant and Sladkov to 


4 Switch direction? Well, you know that there was a download 


5 from DFIN at 12:04 p.m. Just one hour and eight minutes later, 


6 the defendant stopped betting against Tesla and started betting 


7 for it. And Sladkov did the exact same thing at the exact -- 


8 almost exact same time. And you know what that download told 


9 him. The earnings announcement made at 4:23 p.m. was a massive 


10:11 10 win, a huge beat. Instead of that 18 cents per share loss that 


11 the market was expecting, Tesla reported a $2.18 profit. News 


12 that would definitely cause the price to go up, and it did. 
13 When the market opened on July 23 at 9:30 a.m., the 
14 price was up 5 percent. The defendant, Sladkov, and their 


15 associates started selling quickly, and they made good money. 


16 161,000 for the defendant, 1.3 million for Sladkov, and money 


17 for a few of the investors too. The same thing happened again 


18 in January 2020. That's Exhibit 270A. There's another big win 


19 for Tesla. The earnings were $2.06 a share when the estimate 


10:12 20 was only $1.72. The stock shot up, that red spot there after 


21 the earnings release, and the defendant and his team made big 


or himself, 4 million dollars for 


£ 


22 money. 1.2 million dollars 


23 Sladkov, and 1.6 million dollars for the investors, which you 


24 know was another $960,000 for the defendant. 


25 Take a look at Exhibit 270B. Once again, on January 
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1 27th, 2020, the defendant and M-13 were selling short. They 


2 were betting that Tesla's share price was going to drop, and 


3 you can see that all day on January 27th and January 28th. 


4 then on the 29th, right in the middle of the day, just hours 


is before the market closed, the defendant changed his mind. He 


6 starts buying Tesla. Sladkov, Rumiantcev, Borodaev, and 


7 Uryadov also started buying, but switched the defendant from 


8 short to long in the space of a few hours, another download. 
9 This time, the day before he changed his mind and the day 


10:14 10 before Sladkov joined him. Members of the jury, this is 


11 devastating evidence of the scheme and devastating evidence of 
12 a conspiracy. 
13 Sladkov, the man with the M-13 chat app in his iCloud 


14 account and pictures of confidential preannouncement earnings 


15 information on his computer, and the defendant trading in the 


16 same stocks, on the same days, in the same direction. They 
A} even go from short to long together. And they do it, almost 


18 each and every time, right after a download of confidential 


19 information. This was a group of traders making money on the 


10:14 20 same scheme. This is an agreement. 


21 And since we're talking about the 104 IPs, let me 


22 pause for a second on venue. Judge Saris will instruct you 


23 that it's the government's burden to show venue by a 


24 preponderance of the evidence. Our burden for everything else 


25 is beyond a reasonable doubt, but here, more likely than not. 
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1 You've probably heard more than you will ever want to know 


2 about IP addresses and data centers. ight? But here's what 


3 you know. There were 113 downloads over IP addresses starting 


4 with that 104.238.37 block, many of them in alphabetical order 


5 ile Julie Soma was sleeping, Ulta, Aquantia, BPC, Biomarin, 


6 Bioline. The defendant traded in many of the companies whose 


a inancials were downloaded over this very IP address. You 


8 remember the list. Manhattan Associates at the top, Tesla, 


9 Roku, Capstead Mortgage, and many others. We went down his 


10:15 10 list of trades and down the list of downloads back and forth 


11 with Mr. Frank and Mr. Clarke. 


12 Jacob Wall, the now-pilot who used to work at 


13 StackPath, he told you that StackPath leased that 104 block of 


14 IPs from Web2O0b jects as part of StackPath's expansion into 


15 Boston and other cities to get closer to their clients, to give 


16 them faster Internet connections. 


17 Mr. Wall took that authorization and sent it to Micfo, 


18 a company that he'd worked with in many cities. He told you he 


19 id it right away because those IP addresses were expensive and 


10:16 20 time was money. That's where the network engineer do you 
21 remember Aditi Shah? -- that's where she worked. And she told 


22 you she sent that authorization right on to Cogent, the 


23 Internet service provider for the datacenter here in Boston, 


24 with instructions to direct the traffic to the IP prefix 


25 104.238.37 in the location Boston. And Cogent wrote back the 
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1 same day. You know what they said? Done. The date was May 


2 30th, 2018, five months before all of those downloads and all 


3 of the defendants trading over that same IP address. And you 


4 saw the record from ARIN, the Internet registry, putting the IP 


5 just a couple blocks from here, 1 Summer Street, Boston, 


6 Massachusetts. 


7 And you saw paid invoices for that IP just two weeks 


8 after the dates in October and November of those downloads. 


9 You even saw a picture, from September 2018, from Markley's 


10:17 10 datacenter where Micfo was storing server number 7. You see 


11 the label there, BOS-SVR-7, which is where the invoice said was 


12 where the computer was. And Mr. Wall told you that his 


13 customers' experiences would have been bad if the IP address 


14 wasn't in Boston, and he never had a single complaint. 


15 The IP addresses are not part of some grand conspiracy 


16 to try the defendant here in Boston. This was business as 


17 usual. The testimony of those two witnesses, Jacob Wall and 


18 Aditi Shah, tells you that those IP address were in Boston in 


19 October and November of 2018, and all the documents from all of 


10:18 20 those companies with absolutely no interest in the outcome of 


21 this litigation support that testimony. And you know that, 


22 from those IP addresses, the defendant and his crew used Julie 


23 Soma's stolen account credentials to impersonate her and to 


24 hack into DFIN's servers to steal the confidential earnings 


25 information that was stored there, about Tesla, about Capstead 


Case 1:21-cr-10104-PBS Document 218 Filed 02/21/23 Page 37 of 153 


10-37 


ac and dozens of other companies, and to trade on that 


2 information. 


3 And here's what else you know: The parties have 


4 agreed that after his arrest, the defendant was brought 


= 


5 straight to Boston from Switzerland in December of 2021. In 


6 the context of the conspiracy charge only, where the defendant 


7 and his co-conspirators reached their agreement and executed so 


8 much of it from outside the United States, that fact alone, 


9 that he was brought here, is enough to satisfy the venue 


10:19 10 requirement on Count One, the conspiracy charge. 


da. And the evidence from those downloads and from the 


12 defendants trading on those stocks and all the other evidenc 


13 in this case, including his own words and those of his 


14 co-conspirators, tell you that the defendant joined this 


15 conspiracy knowingly, intentionally, and willfully. He knew 
16 what he was doing, and he knew that it was wrong. 


17 For starters, while we're on the subject of the theft 


18 of Tesla's information over the Boston IP, take a look at 


19 Exhibit 152A where the defendant is talking to his two 


10:20 20 investors, Borodaev and Varshavsky. Hours before the market 
21 closes on October 24th, 2018, about 1:28 in the afternoon, the 
22 defendant tells them to take a look at Tesla stock now and 


23 tomorrow after 16:30 and how much it grows once the market 


24 opens in the U.S. The defendant knows how much the stock was 


25 going to grow because just as in those other trades in 2019 and 
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aL 2020, there was a download of Tesla's Exhibit 99 over Julie 


2 Soma's account earlier that morning, using the 104 IP addresses 


3 in Boston. This was a deal that the defendant was trading on, 


4 and he wants to prove to Borodaev and to Varshavsky that he 


5 knew what was about to happen. 


6 But those are far from the only statements that you 
7 have in this case, and not the only ones you have from the 


8 defendant and from his co-conspirators. When you go back to 


9 that jury room, take a good look at Exhibit 46, the Threema 


10:21 10 chat between Ermakov and Rumiantcev, and later with the 


11 defendant and the unidentified man in blue. A chat that 


12 participants thought no one would ever read. In it, the 
13 defendant's two employees, Ermakov and Rumiantcev, discuss 
14 their access to raw data and the need to hide it from the 
15 analyst they hope to hire. 


16 Take a look at this snippet from February 1, 2019, 


une) where they're setting up the cover story. Mr. Ermakov -—- I'm 


18 sorry, Mr. Rumiantcev. "We will modify it somehow so that a 


19 third-party analyst would think the materials have been found 
10:22 20 in open source." Members of the jury, there's no need to make 


21 someone think things have been found in open source unless they 


22 didn't come from open source. And Rumiantcev confirms that for 


23 you. It was raw material that would need to be adapted, and it 


24 can't be passed as is. What kind of data can't be passed as 


25 is? You know the answer. Data that's real. Data they were 
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1 afraid an analyst would start using on the side and profiting 
2 from. 


3 So Rumiantcev talks about creating fake documents to 


4 mix in with the real ones. "Only we will know what forecasts 


is are based on real data." The real data and the raw materials 


6 that they are talking about here were the data that they were 


7 taking from DFIN and Toppan. And you know that the defendant 
8 and Rumiantcev gave the same story to Saxo's Jeff Zorek in 


9 April 2020. Mr. Zorek told you the defendant's trading was 


10:23 10 suspicious because it was largely around quarterly earnings and 
11 it was amazingly profitable, too successful. 
12 At the meeting, the defendant and Rumiantcev told him 


13 that bogus story about M-13's financial analysts and its magic 


14 app, Preston. And the defendant falsely told the bank that he 


15 didn't trade on any kind of confidential information. And Jeff 


16 Zorek told you that the bank let the defendant continue trading 


17 for months. Remember his words? He said there was no 


18 definitive negative information that the bank could point to. 


19 That Saxo call might have gone a lot differently if Jeff Zorek 


10:24 20 had had a chance to read the defendant's supersecret Threema 


21 chat. Lying to banks is not good faith. 


22 In that same supersecret chat, Ermakov and Rumiantcev 
23 talked about diversifying their trades across brokers so that 


24 it would look less suspicious, and they talked about discussing 


25 that concept with the defendant. "I already told Vlad, need to 


Case 1:21-cr-10104-PBS Document 218 Filed 02/21/23 Page 40 of 153 
10-40 


i talk about reducing accounts. Such a number of accounts with 


2 the same securities, with the same broker is a bad idea." 


3 And they worried that the SEC could end up monitoring 


4 their trades. Look at what Ermakov said. The issue is that 


5 the interactive broker demands information on transactions, and 


6 the end, beneficiaries, because this broker is monitored by the 


7 SEC. t continues. The defendant, in green, asked Rumiantcev, 


8 "Why won't we open on interactive brokers by ourselves, just 


9 for information?" The response? "Most likely from fear of 


10:25 10 direct trading and client visibility for SEC." Rumiantcev 


Li chimes in, "I mentioned it earlier, and the broker will see all 


12 ur transactions. The fuck we need this?" Ermakov's response, 


13 Broker sees it even now and can follow up on it. The 


14 regulator," the SEC, "is much more important here." Ermakov 


15 responds, "Europe in this regard" excuse me, the response, 


16 Europe in this regard is probably more preferabl though the 


17 uestion remains to what extent they cooperate with the 


18 American SEC. That's the speaker in blue. And then the 


19 defendant responds, but he doesn't say, Hey, why are we worried 


10:26 20 about the SEC? What's going on here? No. He says, "Our 


21 people from Switzerland say that they're blocking accounts with 


we 


22 no questions asked for six months if the profits are above 20 


£ 


23 percent." Keep in mind that the defendant was on a run that 


24 would net him 900 percent. 


25 Members of the jury, the SEC should not be a problem 
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1 for a company with a legitimate trading strategy. And hiding 


2 from the SEC is not good faith. This exchange is more 


3 devastating evidence of the defendant's knowledge that what he 
4 was doing was wrong. And it's not just the Threema chat 
5 either. Take a look at his WhatsApp conversations with 


6 Ermakov. This is Exhibit 151. Right from the start, you know 


££ 


7 this isn't some ordinary chat between friends. It begins with 


8 them testing each other before they'll actually say anything in 


9 writing. 


10:27 10 The defendant wants to know, "What did Igor bring me 


11 as a present?" And actually says, "I am testing you." It's 


12 only when Ermakov tells the defendant that Igor brought him a 


13 Tesla T-shirt that the defendant will even speak to Ermakov. 
14 You know that conversations that start with strange passwords 


15 and tests are not legitimate conversations. But, of course, 


£ 


riends. They were so close they went 


16 these weren't ordinary 


17 helicopter skiing together in April 2018 for Mr. Ermakov's 


18 birthday, three months before the defendant started trading. 


19 And to the World Cup together with the investors. So close 


10:27 20 they went to dinner after dinner after dinner. So close that 


21 the defendant shared with Ermakov pictures of the yacht that he 


22 planned to buy and gave him a 100-million-ruble loan. That's 


23 about a million and a half dollars at the time. So close that 


24 the defendant bought Ermakov an apartment in August 2020, an 


25 apartment that, as this chat makes clear, Ermakov was going to 
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1 own on paper. The defendant would be the real owner, and the 


2 records would be destroyed. In addendum, it'd say I am the 


3 Signer and you are the owner. It will be destroyed on the 


4 signing. 


5 They were so close that Ermakov, Ivan Ermakov alone, 


6 among the hundreds of employees at M-13, got a car matching the 


7 boss's with a license plate with the company's number on it. 


8 Think about that. An apartment, a 1.5-million-dollar loan, and 


9 a matching car. Just Ermakov, who had no trading account, was 


10:29 10 a lousy trader. You know exactly what Ivan Ermakov brought to 


11 the defendant's table. They were so close that he even made 


12 Ermakov blush when he said stuff like this, "Honestly, I get a 


13 bigger kick when I check apartments for you with you. The fact 


14 that we can walk home together and have a beer or play golf or 


15 simply send everyone to hell knowing that you are close." 


16 The response, "This truly sounds like a nice 


17 declaration of love, like a declaration of love to a girl." 


18 And they were so close that the defendant gave Ermakov the key 


19 to his brokerage account at Saxo Bank with millions of dollars 


10:30 20 in it. And he confided in his friend that his life's greatest 


21 pleasures were his boat and trading. In the WhatsApp chat 


£ 


22 there's talk about things exceptionally close friends do 


£ 


23 together like going to the sauna and shopping for real estate, 


24 but they also talk about their scheme. About the bonkers 


o 2 


25 profits that they're making 


or Borodaev and Varshavsky through 
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al that scheme. Sasha, 693K on one million. That's one of them. 


2 Boris earned 999K on 500K. Those are huge returns in seven 

3 months. And the defendant's comment, "They don't even ask why 
4 anymore." 

5 Who asks a question like that? You know who. Someone 


6 who knows why they're making that kind of crazy money, someone 


7 on the inside. They even talk about watching the television 


8 show "Billions." And they even joke about hacking. Here they 
9 are talking about buying an apartment and that they're going to 
10:31 10 earn the money, and then we can buy, which -- and that's in 
11 June 2020, just a few months before he actually does buy him 


12 that apartment. You just saw those texts. 


13 And when Ermakov comments that he had better get to 
14 work, the defendant says, "No need to. Just turn on the 


LS computer" -—- or "just turn the computer on and think a little 


16 bit," to which Ermakov replies, "I already gave it a thought 


17 yesterday. I will be thinking more today." Tears of joy 


18 emojis. You know what turn on the computer and think a little 


19 bit means: Hack and trade. 
10:31 20 And here's how you know to a certainty that the 
21 defendant knew what he was doing and that it was wrong. Take a 


22 look at what the defendant saved to his iCloud account. This 


23 is Exhibit 150 on the left, and 34 is the photo on the right. 


- 


24 A picture of an article in a protective plastic sleeve, the 


25 kind that people use to keep important documents. Special 
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1. Agent Hitchcock told you that the article was printed in May of 


2 2017, but the photograph was taken more than a year later, in 


3 the summer of 2018. And you know what this article is about, 


4 hacking into corporate networks, stealing the information in 


5 them and making millions trading in the stolen securities 


6 information. 


a Ask yourselves, members of the jury, who saves a 


8 newspaper article about hacking and trading? Who puts it into 


9 a protective sleeve? Who saves it to their iCloud account? 
10:32 10 You know who does that. Someone who that summer, that same 
11 summer, has started doing the exact same thing. Someone who 


12 knows what he is doing is wrong, and not just wrong, criminal. 


13 And that's why the defendant, Ermakov, and Rumiantcev could 


14 speak freely with each other on a Threema chat when they 


LS thought they were just a string of numbers and letters, and 


16 they thought no one would ever read what they wrote. And 


LS} that's also why Ermakov and Rumiantcev got angry when the 


18 defendant slipped up and used the investors' names. 


19 Rumiantcev, "What the hell is this deanonymization?" That time 


10:33 20 the defendant apologized and they went back to their chat. 


21 But then he did it again, and this time it was worse. 
22 He sent pictures of Varshavsky and Uryadov, the investors, to 
23 the chat. Photos that anyone who got access to that anonymized 
24 chat would be able to identify. He wrote, "What did we earn 


25 today? Our comrades are wondering." And you remember what 
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1 happened next. "Vlad, you are exposing our organization. This 


2 is bad," said Ermakov. Rumiantcev, "Vlad, stop sending to 


3 Threema." The defendant, "So sorry." Ermakov, "And that's how 
4 they get you and you end up as a defendant in a courtroom." 

5 Members of the jury, the defendant knew he had screwed 
6 up. He did a dumb thing, and he went on to delete the whole 


7 chat. When Agent Hitchcock searched the defendant's iCloud 


8 account, the Threema app was there, but this supersecret chat 


9 was gone. No discussions of raw materials, fake documents, 


10:34 10 finding brokers who wouldn't cooperate with the SEC. No 


1] discussion of all their trading and spreading it among 


12 different brokerages so that people wouldn't get suspicious. 


13 It was all gone because the defendant didn't want you to see 


14 it, because he knew, just like you know as you're sitting here 


LS today, exactly what it meant. 


16 For his actions, the defendant is charged with four 


17 crimes. In Count One, he's charged with conspiracy to obtain 


18 unauthorized access to commit wire fraud or to commit 


19 securities fraud. In Count Two, he's charged with wire fraud. 


£ 


10:35 20 In Count Three, unauthorized access to computers in furtherance 


21 of fraud. And in Count Four, he's charged with securities 
22 fraud. 


23 Judge Saris will give you the instructions. Always 


24 follow hers, but to prove conspiracy, the government does not 


25 need to prove that the defendant actually committed the thr 
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1 crimes with which he's charged, only that he agreed with one 
2 other person to commit one or more of them. Conspiracy is an 


3 agreement. 


4 Wire fraud -- and those are the elements there -- an 


5 agreement that the defendant willfully joined and the 


6 commission of one overt act by any of the co-conspirators. 


7 Wire fraud has four basic elements, and elements 1, 3, 


8 and 4 on your screen here aren't seriously in dispute in this 


9 case. First, there was a scheme to obtain confidential 


10:36 10 information from TM and DFIN. Second, that scheme involved a 


11 download of confidential information from Capstead and Tesla 


12 and other companies using Julie Soma's user credentials. 


13 Third, there were interstate wires, over the Boston IPs and 


14 others, to DFIN and TM. But you Know by now that the defendant 


15 was a leader of this scheme who did have the intent to defraud. 


16 Unauthorized access in furtherance of fraud has five 


ay Similar elements. Here again, four of which are not seriously 


18 in dispute. Again, there was access to DFIN and TM's computers 


19 over that 104 block of IP addresses here in Boston, using Julie 


10:37 20 Soma's stolen user credentials, which were connected to the 


21 Internet. The hackers took things of value, the confidential 


22 business information of the publicly traded companies, and that 


23 furthered this hack-to-trade scheme. So, again, as to his 


24 intent, you know that the defendant was a leader of this scheme 


25 who had the intent to defraud. 
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i Because the indictment also charges aiding and 


2 abetting, the government does not need to prove to you that the 


Si defendant was sitting behind the keyboard for any of the 
4 substantive counts. We have proven that he aided and abetted 


5 others, like Ermakov, by participating in this scheme that he 


6 wished to bring about. 


7 And finally, securities fraud, four elements with only 


8 one seriously in dispute. There were purchases and sales of 


9 hundreds of stocks and securities as part of this hack-to-trade 


10:38 10 scheme. The scheme involved interstate wires, the download of 


ala material nonpublic information over those same 104 IP addresses 


12 here in Boston, with the same misrepresentation about Julie 


13 Soma's identity, the theft of her user credentials. You know 


14 that the defendant here too had the intent to defraud as one of 


LS the ringleaders of this scheme. 


16 Common sense told Jeff Zorek that something was of 


17 with the defendant's business. Zorek just didn't have that 


18 Threema chat. He didn't have the Threema chat. He didn't know 


19 about M-13's hacking credentials. He didn't have the full 


10:39 20 picture of the defendant's trading. But you do. And like Jeff 
21 Zorek, you also have your common sense. Common sense tells you 


22 that no brand-new trader brings home 900 percent returns 


23 trading only on earnings events and only in the stocks of 


24 companies whose information has been hacked and only at the 


25 time that those companies have been hacked, common sense tells 
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1 you that amazing trading run would not simply stop on its own 


2 when the hacks were fixed. And common sense tells you that 


3 it's wrong to hide from the SEC, and it's wrong to lie about 
4 you're doing. 
5 Now that you've seen and heard all the evidence, you 


6 know that the defendant did those exact things. He broke the 


7 law. All the evidence in this case, the records and documents, 


8 the chats and the testimony, lead to a single inescapable 


9 conclusion: The defendant is guilty, beyond a reasonable 
10:40 10 doubt, of each count in the indictment. Thank you. 


all THE COURT: Thank you. I think this would be a good 


12 time for us to take our morning break. I'll see you back here 


13 at 11:00. 
14 THE CLERK: All rise. 
15 JUROR: Still no talking about it? 


16 THE COURT: Don't talk about it. Don't talk until 


ay you've heard everything. 


18 (Jury exits.) 


19 THE COURT: Let me just say this -—- we'll come back at 


10:41 20 11:00, but you're ballpark, an hour? 


21 MR. NEMTSEV: Hope to be less. 


22 THE COURT: Totally up to you. Let's say an hour. So 


23 that's 12:00. Let's say no longer than half an hour, 12:30. 


24 That's when Mem ordered lunch for them. We'll have a brief 


25 lunch and then come back around 1:00, probably, for the charge. 
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i Okay? That's subject to change. Thank you. We'll just take a 
2 quick 20-minute break. 

3 (Court exits.) 

4 (A recess was taken, 10:42 a.m.) 

5 (Resumed, 11:03 a.m.) 


6 THE CLERK: All rise for the jury. 


a (Jury enters the courtroom.) 


8 THE COURT: Great. You may be seated. Mr. Nemtsev. 


9 MR. NEMTSEV: May I proceed? 


11:06 10 THE COURT: Yes, you may. 


11 We need another notepad. Are you completely out? 


the record.) 


12 (Discussion o 


13 THE COURT: Great. We are all ready. 


14 [NG ARGUMENT BY MR. NEMTSEV: 


15 MR. NEMTSEV: Good morning, ladies and gentlemen of 


16 the jury. We met two weeks ago when we started this case, and 


17 I want to thank you from the defense team for sitting here and 


18 listening to this evidence. I know that you all have 


19 commitments at work and at home. I want to thank you for 


11:08 20 taking the time to listen to this case. We all understand that 


21 you're sacrificing a lot by devoting your time to being here, 
22 and for that, we thank you. 


23 The openings that we gave you was a preview, a promise 


24 of what evidenc ither the government or the defens xpected 


25 to produce during the trial case, during the trial part of the 
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1 evidence. Mr. Frank said the government will prove that 


2 Mr. Ermakov, a friend of Vlad's, was the hacker, that he stole 


3 fidential information from two major United States—based 


4 filing agents, and gave Vlad access to that information about 


5 the financial performance of companies that those filing agents 


6 serviced so that Vlad can trade on the basis of that information. 


7 I promised you that there would be gaping holes in the 


8 government's case, that there would be no witness, no message, 


9 no email that shows that Vlad knew anything about a hack or the 


11:09 10 fact that any trading was based on confidential, stolen 


1] information. And in fact you didn't see a single message, a 


12 Single picture, a single earnings report, or even the words 


13 "DFIN" or "Toppan" in any conversation with Vlad, including the 


14 130,000 ones that they seized through his iCloud. 
15 Many legal systems around the world presume that if 


16 the government brings an accusation, then a defendant is 


Ls} guilty. That's the presumption of guilt, that a defendant in 


18 these legal systems must prove his or her innocence to the 


19 prosecutor. Not in this country, not in this courtroom. The 


11:09 20 government failed to prove what they promised, that Vlad 


21 knowingly, willfully, and intentionally engaged in hacking or 


22 trading on the basis of nonpublic material information as a 


23 result of these hacks. The most sacred principles that make 


24 our legal system the envy of the world is that the accusations 


25 are not evidence. Vlad is presumed innocent. 
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il I told you at the beginnings of this case, and I'll 


2 tell you now, we have no burden to produce any evidence, no 


3 burden to testify, no burden to prove his innocence when the 


4 prosecutors and agents of the most powerful federal law 


5 enforcement agencies have failed to prove their case with 


6 convincing quality evidence, like witnesses and documents, not 


7 theories and inferences, sufficient to prove each and every 


8 element of every charge beyond a reasonable doubt. These 


9 principles are the very foundation of freedom from reckless and 


11:11 10 false accusations. These are the principles that protect 


11 someone from the ultimate horrors of our legal system, that an 


£ 


12 innocent man or woman will be convicted of a crime that they 
13 did not commit. We'll navigate through the evidence and see 


14 whether it creates one or many reasonable doubts based on the 


15 government's failure to prove to support their claim that Vlad 


16 is guilty of hacking and trading based on hacked information. 


17 If Vlad wasn't a Russian citizen, I would have said 


18 that he accomplished the American dream. He grew up poor. He 


19 worked since the age of thirteen. He worked his way through 


11:11 20 law school and then business management in school, and started 


££ 


21 a successful tech company that provided media monitoring 


22 services, cybersecurity services. That's all that we strive to 
23 be, to be innovators, to start and run successful businesses. 
24 There's no dispute that M-13 was a functioning, 


25 successful business. No dispute that it was in operation for 
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1 ten years. There's no dispute that it had more than 300 


2 employees. There's no dispute that Vlad was overseeing major 


3 projects and staffing them with dozens of engineers and other 


4 IT professionals that worked for M-13. There's no dispute that 


5 M-13 had private and government contracts. There's no dispute 


6 that the company's main product line was a media monitoring 


7 service that reviewed, categorized, and analyzed 40,000 media 


8 publications at a given moment. 
9 The government doesn't even dispute that Vlad 


11:12 10 continued to innovate and break into the fintech space; one way 


11 through Preston, a system designed to analyze and trade stocks 


12 based on market sentiment. The government doesn't dispute that 
13 the system was available on the Apple Store, that it was tested 
14 by Saxo Bank employees, who openly told Vlad and his company 


LS that they liked it. There's no dispute that what Vlad was 


16 building with Preston was something unheard of. 


17 Mr. Zorek, one of the only unbiased witnesses in this 


18 case, who was dragged from his retirement home in Florida to 


£ 


19 testify before you, testified to you that he believed Vlad's 


11:13 20 Preston application was viable, that others on Wall Street have 
21 been working on what he was doing for years, and he even 
22 compared Preston to a different product that he was familiar 


23 with, Estimize. 


24 The government argued to you just now that Preston is 


25 a cover, but during the Saxo call, Vlad was the one who 
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il insisted that access be given to the Saxo Bank employees. Who 


2 creates an app, puts it on the Apple Store, who spends those 


3 resources in order to create a cover? Who creates a cover app 
4 that they don't intend to use that Saxo Bank employees actually 


5 liked and considered using internally? That's one hell of a 


6 coverup. It wouldn't make any sense. 


7 You heard that the information generated by social 


8 media is potentially a more powerful predictor of the stock's 


9 price movements than even the fundamentals. A tweak from Elon 


11:14 10 Musk could send the stock flying or falling. An investor's 


11 belief in a stock like Gamestop could shoot its price through 
12 the stratosphere. This is the new age of securities 


£ 


13 investment, and Vlad was seeking to be at its forefront. 


14 There's no dispute that Vlad strived to compete 
15 against the largest companies in the world, to grow, to expand. 
16 His company, like Kroll and StoneTurn and many other companies, 


17 provided penetration testing as one of its many services. 


18 There's nothing illegal about it. It's standard practice in 


££ 


19 the cybersecurity industry. And, of 


course, having a media 


11:15 20 monitoring application gives you an edge in this informational 


21 race. Obviously Vlad would have explored these additional 


22 business opportunities. It's not criminal. This is what 


23 capitalism and entrepreneurship is built upon, innovation and 


24 disruption. M-13 was not a cover, and Vlad was not motivated 


25 by greed. He had wealth and success long before a single stock 
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i transaction was placed in his accounts. He didn't need the 


2 money. 


3 But M-13's prominence in the tech sphere unfortunately 


4 also made him a convenient government target. He's wealthy, 


5 he's Russian, and he owns an IT company that provides media 


6 monitoring and cybersecurity service to the Russian government. 


7 And as I said at the start, there's nothing illegal 


8 about any of those things, but those were the reasons that the 


9 government targeted him. They predetermined that a hack means 


11:16 10 that it must have come from Russia, regardless of whether it's 


1] true or not. They worked to fill that story, that theory, and 


12 no one more conveniently fit that theory than Vlad, the wealthy 


13 Russian IT professional. 


14 The government tried to deny it. Agent Hitchcock 


15 testified that he and his colleagues didn't look at M-13's 


16 website until Vlad's arrest. If you believe him, you have to 


Af ask, what were dozens or almost two dozen agents doing for 


18 these year and a half or two years that they were investigating 


19 this case? The truth is, Vlad and M-13 are such a convenient 


11:17 20 target that the government didn't even bother to think about 


21 any other explanation. Since the start of this criminal 


22 investigation, the government has been pursuing the theory that 


23 it was either Vlad or someone close to him that has to be the 


24 hacker and there's no other explanation, ignoring all the 


25 evidence that points in the other direction; but as we go 
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i through the evidence together, you will hopefully see what I 


2 see. 


Si I do want to bring up one important point. Our legal 


4 system is adversarial. The prosecutors in this case, the FBI, 


5 the SEC, and every other government agent, is not here to help 


6 the defense. They're not here to present facts that are 


7 favorable to both sides. They're here to win their case as 


8 much as I am here to win mine. They believe in Vlad's guilt 


9 Since the day they learned of him. They've been working 


11:18 10 tirelessly to convict him. We saw this during questioning, and 


‘lal no one, not a single agent, would give me a straight answer. 


12 It's not because they don't know how to, it's because they 


13 don't want to, because giving a clear and accurate answer would 
14 hurt their positions. 
15 For starters, there's no evidence that Vlad engaged in 


16 any hacking. The evidence was conclusive. Mr. Hartvigsen 


£ 


17 testified to you that he had a team of twelve people responding 


18 to DFIN's data breach. The earliest evidence of a hack that 


19 they located was from September of 2017 with more complete log 


11:19 20 files dating back to February of 2018, and he testified 


21 conclusively that the dates of the last intrusion was 


22 August 20, 2018. 


23 Vlad had no motive, no incentive to engage ina 


24 hacking in September of 2017, given he didn't have a trading 


25 account for almost ten months. And the government doesn't 
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1 allege that Vlad hacked anything himself. There's no evidence 


2 that he had the technical skills to personally do a hack. He's 


3 the person at M-13 responsible for attracting capital and 


4 investors and getting business. He's not the technical 


5 irector of M-13, nor is he himself the person who knows how to 


6 pick and trade stocks. It was Ermakov and Rumiantcev who had 


7 the exclusive decision-making power to buy or sell stocks in 


8 Vlad's account, and obviously he wanted updates. It was his 
9 money that was being invested. You don't give someone millions 


11:20 10 of dollars of your money and not ask for updates as to what is 


11 happening with it, but there's no evidence that he was deeply 


12 involved in the research or the trading. 


13 In its opening argument, the government promised to 


14 you to prove that Ermakov was the hacker. These are the words 


15 from just two weeks ago. There's no dispute that Ermakov 


16 worked for M-13. This is an employee list of all M-13 


17 employees assigned to just one single project. It includes 46 


18 people, nearly 20 engineers, 20 other professionals. There's 


19 no dispute that what's listed in this document is true. M-13 


11:21 20 was a large company. It had many employees, both technical and 
21 administrative. They worked on large projects. There's no 


22 dispute that Ermakov was the Deputy Director General of M-13. 


23 There's no dispute that Mr. Rumiantcev was the Deputy Director. 


24 They were clearly part of the management team. But there's no 


25 evidence that Ermakov had the level of sophistication and 
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1 computer wizardry necessary to pull off this complicated 


2 computer intrusion. If he was sophisticated, he would have 


3 been prominently featured amongst the various IT professionals 
4 that M-13 had at its employment. 


5 This is a proposal that Agent Hitchcock read a portion 


6 Of. t's Exhibit 141. This is the last page. This is a 


7 proposal that Vlad submitted to a major company to provide 


8 penetration testing services. You can read it. It's 16 pages. 


£ 


9 It's detailed and extensive and includes all of the information 


£ 


11:22 10 about their services. The last page includes a list of experts 


11 that are assigned to the project. Ermakov is not the head of 


12 the Informational Security Department, or the head of the 


13 Penetration Testing Unit, or the head of the Security Analysis 


14 Unit, or the head of Audit and Consulting Unit. The only 


15 evidence that Ermakov is responsible for hacks is in one IP 


16 address that overlaps with DFIN logs and was located on his 


17 iTunes application. 


18 This is the log file showing that the IP address in 


19 May 9th of 2018 was used by Mr. Ermakov to update his Mac apps. 


11:23 20 We know from Mr. Roberts' testimony that there's simply not 


21 enough IPs in the world to accommodate every person, every 


22 business, every internet-connected device. We have to share 


23 them with our neighbors, with our friends, with strangers, and 


24 everybody else. He testified there could be thousands, tens of 


25 thousands, hundreds of thousands of people using the same IP 


11:24 10 


11:25 20 


21 


22 


23 


24 


25 
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address every day. You and I likely have the same IP address. 


It's not strange. It's just the way the Internet works. 


So what do we know about this IP address specifically? 


Nothing. You didn't receive any information about it. You 


have not heard any testimony about who it belongs to, who 


serviced it, or whether it was associated with any VPN. You 


know it was an AirVPN address; it was not a StackPath address. 


The evidence relating to this IP address is just absent. Why 


didn't the government present any evidence about the IP? 


don't know. Ask yourself, though, was it likely that this IP 


£ 


was shared by hundreds of thousands of people at the same tim 


And based on Mr. Roberts' testimony, I believe it's an 


affirmative "yes. 


OW 


ow] 


There's another hole in the evidence that I don't 


derstand and I can't even begin to explain to you. We all 


that iTunes means you have a Mac. You can't update an 


droid or a Windows from the Apple iTunes store. It's common 


ledge. It makes perfect sense. You're talking about two 


comp] 


etely different programming ecosystems. Just like an 


iPhone user doesn't update their phone from a Google Playstore, 


PC users don't update their applications from iTunes. 


S 


at 


Mr. Brawner from Kroll and Mr. Hartvigsen from 


toneTurn, whose twelve-person team investigated the intrusions 


IN, they both told you that the intrusions took place 


using a Windows computer. The computer intruding and Ermakov's 
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1 Mac are completely two different computers. There's no 


2 evidence that Ermakov ever used a Windows laptop. The onl 


3 people in this case that used a Windows computer are peopl 


4 took selfies of themselves with earnings reports on their 


5 Windows laptop, Mr. Sladkov and Mr. Irzak. 


6 If there's a person that the government wants to point 


- the finger at as the hacker, as the perpetrator, they shouldn't 


8 point the finger at Ermakov or Vlad. They should point the 


9 finger at Sladkov. He's the only person in this case to use a 
11:26 10 PC, the only person to have an earnings report prior to its 
11 release, not on one occasion, not on two occasions, but on 


12 three occasions. He's the only person to have a trading 


13 account in 2017, which is the start of the intrusions. This is 


14 reasonable doubt about the government's theory. Their theory 


15 is dependent on Ermakov being the hacker because he is close to 


16 Vlad, but the evidence doesn't support it. 


A} Mr. Hartvigsen told you that they don't have log 


18 files, but they did have some evidence that the intrusions 


19 started as early as September of 2017. The only person who 


11:26 20 could have done anything with that information was Sladkov. 


21 The only person who had any motive to hack a filing agent at 


22 the time was him. Vlad didn't have a trading account for 


£ 


23 almost a year from then. Ermakov never had a trading account. 


24 The only trading that Ermakov did was in Vlad's accounts and 


25 the accounts of Vlad's investors. And as you review the 4,000 
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1 Threema messages, you'll see that it's Ermakov and Rumiantcev 


2 discussing what trades to place and what to place them on. 


3 It wouldn't make sense for Vlad to hack or order 


4 somebody to hack the filing agents in this case and not do 


5 anything with that information for almost a year. 


6 There's another important fact. Vlad only met Ermakov 


7 in March of 2018. That was the first time that Ermakov was 


8 added to his contact list on his phone. The first time that 


9 they went anywhere together, you saw, was April of 2018, and 


11:28 10 even after they met, Vlad still had no trading accounts until 


11 many months later. 


12 And you heard that Vlad and Ermakov were close. They 


13 went to the sauna together; they had deep conversation. It was 


14 a bromance, clear and simple. But look at the dozens of charts 


15 that Mr. Clarke created. In almost every single instance, the 


16 first person to place any transaction following a download is 


17 Mr. Sladkov, at times not by hours but by entire days. If 


18 Mr. Ermakov was the hacker, if he was the one that obtained the 


£ 


19 reports, ask yourself, why would Sladkov be the first person to 


11:28 20 know? Ermakov was close to Vlad, not to Sladkov. It wouldn't 


21 make any sense for Ermakov to prioritize Sladkov over Vlad with 


22 this information if he had it. Vlad was his employer. He paid 


23 him. There's no evidence that Ermakov received a birthday 


24 card, let alone a payment from Sladkov. There's just no 


25 evidence that Ermakov ever hacked or had an earnings report in 
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1 his possession. 


2 And what else do we know about Sladkov and Irzak? Not 


3 much, in all honesty. We spent more time talking about yachts 


4 and vacations to the Maldives than these two key individuals in 


5 a five-person conspiracy. All we know is that Sladkov and 


6 Irzkov lived in a different city 450 miles away. Sladkov knew 


7 Ermakov, but that was the extent of the evidence. Evidence of 


8 their friendship was essentially nonexistent. They messaged on 


9 WhatsApp, sent each other pictures. Some of those pictures 


11:29 10 were ones that Vlad sent to Ermakov, although there's no 


11 evidence that Vlad ever asked or knew that Ermakov forwarded 


12 those pictures to Sladkov. That's the entire extent of the 


13 friendship between Ermakov and Sladkov. Sladkov never attended 


14 his birthday party -- we watched a video of it -- or other 


15 events that Ermakov and Vlad attended together. The other 


16 pictures that you saw shared between Ermakov and Sladkov were 


17 the ones that were put into evidence, a handful of pictures at 


18 best, and none of them include a picture of an earnings report. 


19 The overlap in trading is a red herring. Sladkov and 


11:30 20 Irzak traded many more companies and events than Vlad. Irzak 
21 had 484 trades around earnings, but they overlapped only a 


22 little more than half the time. This is Mr. Clarke's charts. 


23 You can see trading episodes for Mr. Sladkov are 375? His 


24 chart 255 only indicates that 227 of Sladkov's trades were in 


25 the same stocks in the same direction out of the 343 
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1 earnings-—based trades that Vlad made. It's not that every 


2 single transaction in every single stock overlaps. It's a 


3 little more than half. 


4 Sladkov and Irzak are also the only ones with 


5 five-figure returns. Sladkov made more than 11,000 percent 


6 return. Irzak made more than 21,000. That's an outlier 


- compared to every single other person that traded based on 


8 earnings in this case and this time period. 


9 And I don't know whether Sladkov and Irzak had DFIN or 


11:32 10 Toppan or purchased this information from somewhere else. It's 


‘lal not my job to investigate that, but the evidence in this case 


12 tends away from the government's theory that Ermakov was the 


13 hacker and Vlad was his supporter. The evidence does not 


14 compellingly demonstrate that Vlad, or anyone else on his 


15 behalf, hacked these two filing agents, or that he or Ermakov 
16 ever had possession of an earnings report, or that Vlad had 
17 knowledge that any transaction was based on material nonpublic 


18 information. 


19 There's also no tie to M-13 and the alleged hacking. 


11:32 20 Again, there's no evidence that M-13 or Vlad were involved in 


21 any intrusions when they started ten months prior to Vlad's 


22 opening up a trading account. The intrusions didn't change 


23 over time. It was the same Julie Soma account that was being 
24 accessed in early February, pre-Vlad's opening of the trading 


25 account and through January, 2020. 
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1 The government tries to tie M-13 to AirVPN addresses. 


2 That's such a stretch of the facts. r. Roberts expressly told 


3 you that the records show that it wasn't M-13 that was 


4 connecting to AirVPN; it was AirVPN that was trying to connect 


5 to M-13 in January of 2020. There was one sole response from 


6 the M-13 server. I don't know what it is. It's not my job to 


7 investigate it. Al I can say is, there's no evidence that the 


8 short communication transmitted data so small, it could hardly 


9 contain a tiny picture. It could have been related to any 


£ 


11:34 10 intrusion, given how much information was purportedly downloaded 


11 and obtained from these two filing agents. 


12 Mr. Hartvigsen testified to you that AirVPN was just 


13 one of the 26 ISPs and one of 110 IP addresses that matched to 


14 intruders. There's no evidence that Vlad or M-13 used any 
15 Single one of them. 


16 With all its enormous power to get documents and bring 


Ly witnesses before you, which you saw when they took Ms. Shah 


18 from North Carolina, located her and placed her before you in 


19 the matter of a day, the FBI didn't even attempt to ask AirVPN 


11:34 20 and StackPath, or any of the other 24 ISPs, whether Vlad or 


21 Ermakov or M-13 had an account there. Mr. Wall, the individual 


22 from StackPath, he testified to you that there was no free 


23 service back then. In order to get onto StackPath's servers, 


24 you needed a name, an address, a credit card. When I asked 


25 him, "Did you check your records for Mr. Ermakov, or 
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1 Mr. Klyushin, or Mr. Rumiantcev, or M-13?" he said, "The FBI 


2 never asked me that question." 


3 They put in a statistician to confirm their theories. 


4 Mr. Clarke's job was not to analyze the data and independently 


5 determine whether they had made the correct decision. They 


6 gave him the data that they wanted him to use. They told him 


- the dates that they wanted to use. The dates that they told 


8 him don't match the testimony of the witnesses that testified 


9 to you about the intrusion. I told him to statistically prove 


11:35 10 that this trading wasn't random. Why randomness is the 


11 baseline for trading in stocks and making decisions to buy or 


12 sell stocks is beyond me. The stock market is not random. 


13 Selecting stocks and deciding to buy or sell is not random. 


14 You know that. I know that. Otherwise, thousands of hedge 

15 funds and investment banks and money managers, they'd be out of 
16 work. 

17 The government had a predetermined conclusion that 


18 they had to use math to try to satisfy. They're hoping that 


19 the confusing, incomprehensible interpretation of what a 


11:36 20 p-value is was enough to convince you that there could be some 


21 possibility that Vlad's trading was related to a hack. 


22 A while back I read a book. It was called 


23 "Freakonomics." It was an economist using statistical models 


24 to tie the most random events in the world, and it just went to 


25 prove that correlation isn't causation. And that's the same 
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1 thing that Mr. Clarke did: He used statistics to create a 


2 piece of evidence to present to you because they lack all other 


3 actual evidence. They had to fill their holes, and they used 
4 math to do it. But math and statistics are not the direct 
5 evidence that you would expect to see in order to deprive a 


6 person of their liberty and their innocence. The issue is not 


7 that Vlad made a lot of money. It's why. 


8 The question is what direct evidence they have that he 


9 knew that any transaction was placed on the basis of material 


11:37 10 nonpublic information. This isn't a civil case where someon 


1] is suing someone. This is a criminal case. What distinguishes 


12 a criminal case is not that just the act of buying the right 


13 stock, but that the act was done with knowledge that Vlad 


14 actually and knowingly possessed confidential information, 


15 meaning the stolen earnings reports. It's the pivotal element 


16 in this case. 


17 They seized his iCloud. He wasn't expecting a 


18 seizure. He was thousands of miles away from the 


19 investigation. Think of what they would find if they had 
11:38 20 seized your iCloud and searched your iCloud. And despite that, 


21 there's not one scintilla of evidence that Vlad had any access 


22 to the hacked confidential information. 


23 And as you saw, begrudgingly, Agent Hitchcock 
24 confirmed that to you. Mr. Roberts confirmed that to you. 


25 Hundreds of thousands of texts, phone logs, Web searches, 


11:39 10 
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The fallback is that this is 


but this is just another way of saying 


that they didn't find anything that they expected, and don't 


want to blame themselves for pursuing the wrong guy. It's 


earnings reports that were serviced 


trade in. 


incompetent, 


They 


couldn't figure out 


numbers were better or worse. They 


lines down to see what the guidance 


by 


inconsistent with their arguments that Vlad's team was so 


they couldn't figure out which of the 3,000 


the filing agents to 


apparently whether the 


couldn't read a couple of 


was. 


If Vlad wanted to 


£ 


trade on the basis of material nonpublic information, he could 


have dedicated 10 percent of the resources of M-13 to review 


and check and analyze every single earnings report that was 


contained within the files of the two filing agents. 


The government also presented a chain of inferences 


that took days to explain about how the Wan Connie account and 


11:40 20 


2] 


its Bitcoin transactions tracked back to other Namecheap 


accounts that purchased domain names. 


to you how attenuated that connect 


one thing, 


and it's something that 


we a 


can't begin to explain 


tion is, but I can tell you 


ll know: Every person 


in this room is connected by 6 degrees of separation. It's a 


22 


23 


24 


25 


common fact. 


fF you go six steps o 


Mey, 


everyone is connected to 


each other in the world, and the digital world is no different. 


If we had 


enough, yo 


u woul 


ld probably be able to link every single one of 


Bitcoin accounts and the government tracked back far 
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ac us to those same domain names. 


2 When you start off with predetermined conclusions, 


3 you're seeking to confirm that conclusion, not evidence to 


4 contradict it, and that's what they did in this case. They 


5 started off with a predetermined conclusion that the hacker 


6 must be Vlad or someone very close to him, and every other 


7 Single part of their investigation was intended to confirm that 


8 initial belief rather than contradict it. 


9 It's no hidden secret. You have the Threema chat. 


11:41 10 wasn't deleted by Mr. Rumiantcev. You can review all of it. 


11 You can see that the Threema chats span almost a year of 


12 trading. From the start of the chat group in October of 2018, 


13 it was solely Mr. Ermakov and Mr. Rumiantcev discussing which 


14 positions to open and which positions to close. The only 


15 updates that they ever sent Vlad were the financial ones 


16 relating to trading profits and losses. 


17 Vlad was brought into the chat in May of 2019, almost 


18 seven months after it was created, and even after he was added 


19 to the chat —-- and you could look for yourselves he 


11:41 20 participated very minimally. He tells the group openly that 


21 he's unable to help in active trading. It was a different chat 


22 in the WhatsApps where Vlad asked Ermakov, "Do you need help 


23 with Saxo?" and Ermakov tells him "No." He tells the group 


24 openly what he believes his trading is based on: It's based on 


25 his monitoring system, 18,000 messages per week. 
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1 These are chats, July of 2019. I showed them to you 


2 during the opening. They're chats between Mr. Rumiantcev and 


3 Mr. Klyushin discussing the difficulties of collecting and 


4 analyzing data from Twitter. Mr. Rumiantcev says, "We have the 


5 Tesla collection set in Twitter at 100 percent. It's under 


6 tickler only. We get 11,000 messages per week." They 


7 iscussed the difficulties of analyzing all of that 


8 information, and Vlad tells him, "We're trading thanks to this 


9 know-how only. Everything is done by neuron networks plus 


11:43 10 monitoring." 
11 This isn't a coverup. This is months. This is July 


12 of 2019. The conversation with Saxo Bank takes place in April 


13 or March of 2020. This is many months before that. This isn't 


14 in preparation for any call. This is what Vlad believes. This 


15 is what is in his mind. No one tells Vlad in that chat, none 


16 of the other participants tell him, "What are you talking 


17 about? This isn't how we do it. Why are you making us analyze 


18 all of these Twitter messages? We trade on hacked reports. 


19 You know that." 


11:44 20 And Vlad had no reason to lie to a single person in 


21 this chat. The government will tell you that he had a reason 


22 to lie in this chat: All of the people in this chat are 


23 supposedly his coconspirators. They are alleged to be active 


24 participants in this hacking and trading scheme. Why would 


25 Vlad say this unless he believed that it was true? If Vlad was 
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1 trading based on hacked information and he knew it, why would 


2 30 percent of his trades in the period of the hack be in 


3 non-earnings-related events? Why would he not stop his team 


4 from trading after the hacks end? The only explanation is that 


5 he is not basing his trading on the existence of the hacks, 


6 that he did not know that any material nonpublic information 


7 was being used to place his trades. 


8 Another issue: If Vlad was the one that was making 


9 investment decisions and purchasing and selling, why is there 


11:45 10 trading in his accounts after his arrest? Agent Hitchcock did 


11 not tell you that he had Internet access or a computer from a 


12 Swiss prison. Those trading decisions were being made by 


13 somebody else. It's not enough that transactions took place. 


14 It's not enough that money was made. You'll hear that Vlad had 


15 to know that the information that was being used to trade came 


16 from the results of a hack, and there's no witness, no email, 


17 no message that confirms that critical fact. The government 


18 obtained 43 search warrants, had assistance from the SEC, had 


19 international law enforcement assistance, issued dozens of 


11:46 20 subpoenas, had assistance from Saxo Bank, and there's not a 


21 Single piece of evidence that Vlad knew that the basis of any 


22 stock transaction was hacked information. 


23 Vlad's iCloud, like all our iClouds, are repositories 


24 for virtually limitless amounts of information. There's no 


25 evidence that he was hiding anything. It was all out in the 
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1 open. The government found his most intimate conversations 


2 with his wife, his children. Where is the communication or 


3 email or picture that shows that Vlad possessed, reviewed, or 


4 used material nonpublic information? Nothing out of the 95,000 


5 pictures or the 130,000 messages proves it. This was confirmed 


6 by the FBI and Mr. Roberts, who conducted his own searches of 


7 Vlad's iCloud. Where's the proof that anyone told him that the 


8 source is insider or hacked information? There simply isn't 


9 any. Where's the information that Sladkov told Ermakov that 


11:47 10 the source of information was a hack? Where is the evidence 


11 that Ermakov told anything to Vlad? Where's the proof that 


12 Vlad, who told one of the investors about Tesla going up on 


13 October 24, 2018, related to material nonpublic information 


14 rather than something else, including potentially a deep dive 


15 in a market study? There's nothing. 
16 The government admits that Vlad did not hack himself. 
17 They guessed that someone told him something, but you don't 


18 guess people into prison. 


19 Vlad wasn't hiding his strategy either. The Saxo call 


11:47 20 that we listened to was a call that was initiated by Vlad and 


21 his trading team to get enhanced services. The first part of 


22 the call they asked for more leverage, wanted larger trade 


£ 


23 windows; they wanted to get additional power of attorneys over 


24 accounts. You don't get on a call with a major investment bank 


25 in order to get enhanced services when you're trying to hide 
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1 the fact that you're trading on insider information or hacking 


2 major U.S. filing agents. 


3 When it's not proven, it's not guilty. The government 


4 can't prove its case through possibilities or probabilities. 


5 Even proof by clear and convincing evidence, a different legal 


6 standard, is not enough. You must prove these allegations 


7 beyond any and all reasonable doubts. That is what is required 


8 under the law. It has to be a smooth ride, not filled with 
9 gaping holes. 
11:48 10 The government showed you chats about picking a 


11 brokerage to reduce the scrutiny of the SEC, puts a lot of 


12 weight on it, I get it. But you heard it yourself: In the 


13 securities industry, the SEC is the IRS. An audit from the SEC 


£ 


14 to a trader is the same as an audit from the IRS to us. Nobody 


15 wants to be part of an audit. The same way that I tell my 


16 accountant to make sure that I don't get audited, that's the 


ay same reason that traders and trading firms try to minimize 


18 their scrutiny by the SEC. You can go to State Street downtown 


19 or Fidelity. I don't think a single banker or employee will 


11:49 20 tell you that they welcome the SEC to come in and look at their 


21 transactions. 
22 Mr. Zorek told you that Saxo Bank did not take on 


23 clients for that very reason. The regulation and scrutiny 


24 brings is too inconvenient to justify the costs. The nine 


25 terrifying words in the English language are "I'm from the 
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1 government and I'm here to help." And imagine hearing that if 
2 you're Russian. 


Si Their transactions were already scrutinized. They 


4 were already designated as being from a high-risk country. 


5 They had difficulty getting access to Bloomberg terminals 


6 because they were Russian. Why wouldn't they attempt to find a 


£ 


7 broker that reduced their chances of getting audited? Vlad 


8 knew that 20 percent returns on the transactions would mean an 
9 automatic closure just because he was Russian. Why would 
11:50 10 anyone want to deal with that? 


Li And even then he says that the SEC, in that chat, that 


12 the Interactive Broker complies with the SEC, gives them th 


13 information. But you know what? He still used Interactive 


14 Broker. It was one of the trading accounts that was open in 


15 his name. It was one of the accounts that trades got placed 


16 in. It wasn't so much about evading detection as it was making 


17 sure that his business runs smoothly. 


18 The last message in the Threema chat was about 


19 supposedly exposing the organization, but it was not exposure 


11:51 20 of criminality that they were discussing. It was exposure 


21 about the identities of the investors. That last chat was not 


22 the only time that it happened. Take a look. Months earlier 


23 they had the same thing where Vlad disclosed the names of the 


24 investors in the chat group, and they yelled at him for doing 


25 that, and he said, "I'm so sorry. I'm just here for finances." 
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il And Rumiantcev did not believe that chat, despite what he said. 


2 There's an additional constitutional issue that you 


i) will need to resolve. It's important. It goes to the heart of 


4 protections that a person cannot arbitrarily be put on trial in 


5 any place that the government wants. As Judge Saris will tell 


6 you, Vlad can only be tried in a place that has a meaningful 


7 connection to the allegations. There's no dispute that Vlad 


8 was not in Massachusetts at the time of the charged conduct. 


9 There's no dispute that the two filing agents are headquartered 


11:52 10 outside of Massachusetts or that their servers are located in 


11 other states. The only meaningful connection alleged is the 


12 use of this Boston IP address in connection with an intrusion 


13 DFIN's servers from October to early November of 2018. 


14 [ the 104.238 IP address that no one can prove was in 


is) Boston. 


16 This constitutional protection goes to the very heart 


Ly of the establishment of the United States. It emanates from 


we 


18 wanting to protect American citizens and others from the 


19 arbitrary decision of governments to pluck individuals from 


11:53 20 their homeland and try them thousands of miles away. And it 


AL was what the British before the Revolution used to do, and it 


22 was for those reasons that these constitutional protections 


23 were put in place. 


24 I promised you that you will not hear, and you did not 


25 hear, any evidence that Vlad used that IP address. Despite 
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1 Mr. Wall from StackPath telling you that you needed to sign up 


2 with your name, address, and credit card information, the FBI 
3 made no effort to obtain any user data or confirm that Vlad or 
4 M-13, or anyone else involved, had an account there. There's 


bs no evidence that the Boston IPs, the 104.238 IPs, overlap with 


6 any of the IPs that were used by Vlad or Ermakov or Rumiantcev 


7 or M-13. 


8 There's also no clear evidence that the server was in 


9 Boston. This IP address was registered to a StackPath 


11:54 10 subsidiary called StrongVPN. You heard testimony that 


11 StrongVPN has a status page where it indicates where servers 


£ 


12 are available. That page contained no reference to a Boston 


13 server in September of '18 or March of 2019. Of course there 


14 was no complaint about the server; there was no server. It was 


15 never offered as one of the services by StrongVPN. But the 


16 matter is more complicated. It's that the company that 


17 actually owned the server, Micfo, had committed a fraud during 


18 the exact time period when it was supposed to provide server 


19 space to StackPath. The government tosses its credibility 


11:55 20 behind StackPath, who just three years ago convicted of fraud, 


21 saying that they provided what they promised. 


22 MR. KOSTO: Objection. 


23 THE COURT: I think you just may have misspoken. 


24 MR. NEMTSEV: That's how badly they want to convict 


25 They're willing to ignore a fraud committed by Micfo 
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i they just prosecuted three years ago. The larger issue 


2 it's unclear what Micfo promised. As you saw from the 


3 invoices, the very first time that Micfo promised to host that 


4 IP address in Boston for a 30-day period was between 


5 December 1, 2018, and December 30, 2018. The IP address was 


6 supposed to be hosted on server 7, but as you saw from the 


7 other invoices, server 7 was occupied by a different IP address 


8 since September and November of 2018. 


9 There's no evidence that the IP that we care about was 


11:56 10 hosted in Boston during this pivotal October to early November 


‘Lal period. There's no evidence that Micfo would provide its 


12 services for free, and there's no evidence that they put those 


13 IPs on that server. And this is not a technicality. This is a 


14 major constitutional problem. It undermines everything that 


LS the government promised to prove in their indictment and 


16 undermines the entire premise of arresting Vlad in Switzerland 


17 and forcing him to stand trial in Massachusetts, a place that 


18 he's never visited, a place where he could never in a million 


19 years imagine being placed on trial. 


It's this constitutional protection that protects you 


11:57 20 


21 and me from being placed on trial in Alaska for conduct that we 


22 committed elsewhere. By putting Vlad on trial here, the 


23 government has undermined our future rights that the founders 


24 of this country guaranteed us. This is the United States. We 


25 treat everyone equal. All the rights that are conferred on you 
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1 and me are also conferred on Vlad as well. Our legal system is 


2 the model for democracies around the world. Vlad is entitled 


3 to the same right as somebody born on Beacon Hill who went to 


4 Harvard. The burden is solely on the government to expunge his 


5 presumption of innocence. Without actual direct evidence that 


6 Vlad engaged or asked someone to engage in hacking of the two 


7 iling agents, and that he knew the stock tips that he had were 
8 based on those hacks, there's no crime. 


9 The key, as Judge Saris will tell you, is in knowing 


11:58 10 an intentional violation of the law. You can't violate the law 


ala by accident. You can't violate the law when you have a 
12 good-faith belief that your team is trading based on information 
13 produced by Preston. This isn't a movie or a game. This isn't 


14 Rocky 4. 


15 You're about to deliberate over the fate and freedom 
16 of a man that is only presumed innocent, but based on the 
17 evidence you received, actually innocent of this gravely 


18 serious charge. 


19 There's a repeated saying in the lawbooks that "Better 


11:59 20 ten guilty go free than one innocent be convicted." That's why 


21 our founding fathers, when they established our legal system, 
22 they fought so bravely to put the burden squarely on the 


23 government and made the burden very high. But even a juror, 


24 especially if a juror suspects a defendant may have done the 


25 crime, they said it's possible that the defendant did the 
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1 crime, thinks it's probable, that's not nearly enough to 


2 convict. They must convince you, each of you, unanimously that 


3 there's no reasonable explanation of the evidence, no 
4 reasonable doubt of guilt, by credible, convincing, even 


5 unimpeachable evidence, a very high standard that has preserved 


6 all our freedom since the brave citizens of Boston fought just 


£ 


7 outside the back door of our courthouse 250 years ago. 


8 His fate, his freedom, his future are in your hands. 


9 He's not seeking sympathy. He sat here facing false 


12:00 10 accusations. I'm asking you to lift the cloud, the burden of 


ala this painful and false accusation that has weighed on him and 


- 


12 his family for 22 months. He's a good man, a man you may not 


13 have heard of do anything wrong. So I ask you to deliberate, 


14 discuss, weigh the evidence against this high standard, and 


15 tell Mr. Klyushin and the world that when the government does 


16 not prove what it promises, does not prove each element of the 


17 crime charged, that the only verdict that is appropriate is 


18 "not guilty." Thank you for your time. 


19 THE COURT: Thank you. You want to stand and stretch 


12:00 20 few minutes, and we'll have the rebuttal. 


AL (Pause.) 


22 THE COURT: This should be about a half an hour. 


23 anyone desperate right now? Okay, and then we'll break. All 
24 right, thank you. Let's be seated. 


25 
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1 EBUTTAL ARGUMENT BY MR. FRANK: 


2 MR. FRANK: Good afternoon, ladies and gentlemen. 


3 am acutely aware that I am the third lawyer to speak to you 


4 over the last several hours, and I am the only lawyer that came 


5 between you and lunch, which is a place no lawyer wants to be, 


6 but I'll be brief, and then you can go on your way. 


7 I want to start with what's not in dispute based on 


8 what Mr. Nemtsev just told you. What's not in dispute is that 


9 there was a hack on DFIN and Toppan Merrill. What's not in 


12:02 10 dispute is that the hackers were sophisticated; they were 


‘lal experts. What's not in dispute is that the hackers stole 


12 confidential earnings information of dozens of companies right 


13 before those companies announced those earnings to the SEC and 
14 to the world. What's not in dispute is that this defendant 
15 runs a company that simulates hacking, this kind of hacking, 


16 for its clients; that he has hacking experts who work for him. 


17 What's not in dispute is that the defendant and his associates 


18 traded in the exact same stocks that were hacked at the exact 


19 same time of the hack, right before those earnings announcements 


12:02 20 were actually announced. 


21 What's not in dispute is that this defendant, despite 


22 never having a brokerage account before these hacks, somehow 


Se 


23 over the next two years made a stunning amount of money from 


24 trading around earnings announcements, tens of millions of 


25 dollars. So did Sladkov, so did Irzak, so did Rumiantcev; so 
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A did the defendant's investors, who gave him a 60 percent cut, a 
2 60 percent cut to a man who didn't even have a brokerage 
Si account before 2018. 


4 And what's not in dispute, members of the jury, is 


5 that after the hack ended in August of 2020, his earnings 


6 trading fell off a cliff, and he started losing money on 


7 earnings trades. Even their own expert, Mr. Tawil, their 


8 expert, didn't dispute that. 


9 For a man who made that much money in that short a 


12:03 10 period of time, I submit to you, he must be the unluckiest man 
Li in the world. He's the unluckiest man in the world to start 


12 his trading career right around the time of a major hack at 


13 DFIN and TM. He's the unluckiest man in the world to have 


14 96 percent of his earnings trade in the shares of the companies 


15 whose earnings announcements were hacked at DFIN and Toppan 


16 Merrill. He's the unluckiest man in the world that his trading 


Ay invariably happens after the hacks and before the news is 


18 announced. He's so unlucky that the hacks can be traced back 


19 through VPNs and Bitcoin transactions to the IP address of his 


12:04 20 company that specializes in imitating hackers; on one occasion, 


21 right back to his best friend, the guy he regularly goes to the 


22 sauna with, Ivan Ermakov, within four minutes of one of those 


23 hacks. Of all the billions of IP addresses in the world and 


24 the dozens of VPNs, somehow they come back to him and his wif 


££ 


25 He's so unlucky that on the computer of one of his 
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al fellow traders, Igor Sladkov, a man who trades in lockstep with 
2 him and has his company's super-encrypted chat apps on his 


3 phone -—- you didn't hear that from the defense, but the M-13 


4 chat app on Igor Sladkov's phone, the man who trades in 


5 lockstep with him, that man has the stolen MNPI, the stolen 


6 earnings information actually on his computer screen. The F1 
7 found it, and we showed it to you. 
8 He's so unlucky, this man, that he actually has a 


9 newspaper article saved in his iCloud account of an article in 


12:05 10 a protected sleeve, a year after it was published, about a 
11 hacker who trades on stolen earnings information to make 
12 millions of dollars. Lo and behold. 


13 He's so unlucky that his remarkable beginner's luck at 


14 trading runs out at precisely the time that the hackers get 


15 locked out of DFIN and Toppan Merrill. 


16 Oh, I almost forgot. He also happens to be involved 


17 in a Threema chat where they're talking about avoiding the SEC 


18 and ending up as a defendant in a courtroom. What are the odds 


19 of that? 
12:06 20 What do you do when your luck is that bad? You do 
21 what you see. You throw everything up against the wall to see 


22 if something sticks: The FBI and the SEC jumped to 


23 conclusions. They targeted him because he's Russian. The 


24 witnesses, you heard every one of them asked, the witnesses 


25 were rehearsed. It wasn't Klyushin because he didn't trade in 
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1 the shares of each and every stock whose earnings were 


2 downloaded, just some of the stocks, just 356 of them. It 


3 wasn't Klyushin because he had a magical app, Preston, that 


4 told him what to buy. That's why he was so successful. It 


5 wasn't his buddy Ermakov, but if it was his buddy Ermakov, he 


6 didn't know about it. No one told him. 


7 If it was anybody, it was Sladkov, and he doesn't know 


8 Sladkov, and he has nothing to do with him, and never mind the 


9 M-13 chat app on his phone and all the other evidence of 


12:07 10 connections to the defendant on his phone. But, really, it was 


11 the victims' fault because they didn't have multifactor 


12 authentication and they had poor password hygiene. You heard 
13 that as well. 


14 And whatever happened, whatever happened, it 


15 definitely didn't happen in Boston. Micfo is the real fraud. 


16 It's Aditi Shah. She's behind the scheme. She's the real 


Ly fraudster. 


18 And a personal favorite, that chat about ending up as 


19 a defendant in a courtroom? That's about investor privacy. 


12:08 20 Let's quickly take a look at a few of those. 


21 Preston, the social media software that the defendant 


22 wants you to believe was the fuel for his investment success, 


23 the magical app that he supposedly wanted Saxo to try, the app 


24 that even Nikolai Rumiantcev said didn't help pick stocks, you 


25 saw it in the Threema chat, the one that counsel just showed 
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il - But he didn't read you the part where Rumiantcev says, 


2 It's generally hard to analyze the status of a security based 


3 on social media networks." That's line 36-87. 


4 And then he goes on to say, "I'm not giving up my 


5 hopes that our capability to collect news and posts in social 


6 media may help us somehow," smiley face. And in response to 


7 that smiley face, the defendant makes a sarcastic response 


8 about how "This is the only reason we have this know-how." 


9 By the way, that was in July of 2019. That was in 


12:09 10 July of 2019 that Rumiantcev said, "Social media doesn't help 


11 us pick stocks." That was one year after the defendant started 


12 trading. And you heard that Saxo Bank had the same reaction a 


13 full year later in 2020. When Rumiantcev sent him the access 


14 to the app, Saxo wrote back, in so many words, "Nice app, but 


LS where's the part about how trading decisions are made?" You 


16 have that in evidence too. That's Exhibit 328A. Rumiantcev's 
17 answer? "Sorry, trade secret." 


18 Counsel asked who creates a cover story about an app? 


19 Who does that? Who goes to those lengths? Well, ladies and 


12:10 20 gentlemen, you Know who does that. You actually saw them 


21 discussing this exact cover story in the Threema chat, Ermakov 
22 and Rumiantcev discussing how they would tell the trader they 

23 wanted to hire, the analyst, that they had an app that analyzes 
24 social and mass media; and they would slip in the real data so 


25 the analyst wouldn't know that it was real data that he was 
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1 looking at, that they would mix it up with fake documents so 


2 the analyst wouldn't know. They actually discussed the exact 


3 cover story. 


4 But here's the thing, another question about Preston: 


5 [f it was so good, why did Preston only work on earnings? Why 


6 didn't it analyze social media and come up with stock 


7 recommendations that worked on other kinds of trades, the ones 


8 where they lost money? If it was so good at analyzing earnings 


9 trades, why did it only work on the earnings trades of 


12:11 10 companies that filed their earnings announcements with DFIN and 


‘lal Toppan Merrill? And if it was so good, why did it break in 


12 August of 2020, just stop working right around the time the 


13 hackers got locked out? Because it wasn't, because it's a 
14 smoke screen, it's a cover story. And whatever it is, whatever 


15 it was —-- and really there's no evidence about it other than 


16 what I've just described to you -—- whatever it was, it wasn't 


17 the reason the defendant and his associates made $90 million 


£ 


18 trading in the shares of companies that filed their earnings 


19 via DFIN or Toppan Merrill. 
12:11 20 The defendant argues it could have been anybody 


21 because there's so many IPs in the world, and that just because 


22 van Ermakov was on the 119 IP within four minutes of the hack 


23 on DFIN using that same IP address, "We don't know anything. 


24 It could have been anybody using those IP addresses. There's 


25 so many IPs. There's so many VPNs." 
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1 Their defense expert, Mr. Roberts, even suggested to 


2 you yesterday it could have been somebody else using the M-13 


3 IP address. Think about that. Who would that person have 


4 been? What, somebody driving by and using the M-13 WiFi? 


5 Boloney, ladies and gentlemen. The IPs come back to his 


6 company. The Bitcoin tracing does the same. 


7 van Ermakov's use of the 119 IP within four minutes 


8 of that IP being used to hack DFIN is devastating evidence. 


9 And, of course, it's his company that specializes in hacking. 


12:12 10 And, of course, it's the defendant who traded in all of those 


11 DFIN and Toppan Merrill stocks, not somebody driving by his 
12 company and using the company WiFi. And it's the defendant who 


13 had the great misfortune of being caught on a Threema chat 


14 talking about avoiding the SEC, and ending up as a defendant in 
15 a courtroom. 


16 He wants you to believe that there's no evidence that 


17 van Ermakov had the sophistication and wizardry to pull this 


18 off. Seriously? You saw him advertise what his people could 


19 do on his own company's website. You saw the brochures. You 


12:13 20 saw him proposing to his clients that they could simulate 


21 exactly this kind of hack. Their argument is that he didn't 


22 put his head of pen testing on it; he only put Ivan Ermakov on 


23 this. You know why he put Ivan Ermakov on this; because they 


24 were besties. He didn't go to the sauna with the head of pen 


25 testing. He went to the sauna with Ivan Ermakov. That's the 


Case 1:21-cr-10104-PBS Document 218 Filed 02/21/23 Page 85 of 153 


10-85 


1 guy he bought an apartment for. That's the guy who had the car 


2 that matches the boss's car with the matching license plates. 


8 Of all the employees at M-13, it was Ivan Ermakov who had the 


4 matching car and who got the apartment and who got the 


5 million-and-a-half-dollar loan from the boss. 


6 He argues that there's no evidence that he did the 


7 hack personally. Well, first of all, that's not true. He's on 


8 the M-13 IP within one hour of it hitting the AirVPN IP that 


9 was used in these hacks. But you also know he doesn't have to 
12:14 10 be the guy behind the keyboard. Mr. Kosto told you he's 


‘Lal charged with conspiracy; he's charged with aiding and abetting. 


12 He doesn't have to have done it personally. He ran the hacking 


13 company; he was in charge; he's the guy who made the money. 
14 And he knew everything about this scheme. Listen to 
15 that Saxo call. Look at the way he takes charge in that Saxo 


16 call and knows about every trade. Look at the Threema chat 


17 where he is filled in each and every step of the way. They 


18 actually say on the Threema chat, "Let's just bring him in so 


19 we don't have to keep going back to him and telling him what 


12:14 20 we're talking about and asking for his permission. Let's just 


21 bring him into the chat." 


22 One of the sillier arguments you've heard is that 


23 because Ivan Ermakov had an iTunes account and used a Mac, it 


24 couldn't have been Ivan Ermakov because we know that it was 


25 Windows operating systems that were somehow involved in the 
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1 hack. Well, you know why that is: because he didn't do it 


£ 


2 directly from his laptop. He went through the virtual servers 


3 at DigitalOcean and Vultr, and those virtual servers can host 


4 all kinds of different software. They can have multiple 


5 different operating systems operating on them at the same time. 


6 He says there's no evidence that M-13 was involved in the 


7 intrusion. I'm not sure if Mr. Nemtsev was at the same trial 


8 that we all were, but I submit to you there was plenty of 
9 evidence that came directly back to M-13. 


12:16 10 He is the one who called the shots, ladies and 


11 gentlemen. He is the one who was the boss of Ivan Ermakov and 


12 Nikolai Rumiantcev. He is the one whose company chat app was 


13 on Igor Sladkov's phone. He is the one who is so tight with 


14 Ermakov. He is the one telling Saxo exactly how this works and 


LS how their trading works, and, of course, he's the one who made 


16 $21 million. 


A} You also heard the argument that: It wasn't the 


18 defendant. It wasn't Ermakov. If it was anyone, it was 


19 Sladkov. And Sladkov started trading earlier, and so that's 


12:16 20 how you know the defendant wasn't involved. 
21 We told you that Sladkov started trading earlier. 
22 There's no dispute about that. You don't have to join a 


23 conspiracy at the very beginning to be part of a conspiracy. 


24 You don't have to join a scheme at the very beginning to be 


25 part of a scheme. And PS, there can be more than one hacker 
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1 involved. It doesn't have to be only Ivan Ermakov. It wasn't 


2 only Ivan Ermakov. He was the defendant's close buddy. He was 


3 the hacker involved in this scheme. So was Igor Sladkov. 


4 That's why he had the confidential earnings information on his 


5 computer screen. That's why sometimes he traded first and 


6 sometimes the defendant traded first. There was a lot of work 


7 involved in this hack, ladies and gentlemen. There was a lot 


8 of work. They were hacking each of those networks using Julie 


9 Soma's user ID and the other user IDs we talked about again and 
12:17 10 again and again. And they had to read all those earnings 


11 reports and try and figure out what they were saying and figure 


12 out which ones to trade off. They were busy. This was not a 
13 one-man job. 

14 Now, the Judge will instruct you that in a conspiracy, 
15 the defendant doesn't have to know each and every conspirator. 
16 He doesn't have to be involved in each aspect of the scheme. 


Ls} He just has to have a general understanding of the scope of the 


18 conspiracy. But you know that he actually does know Igor 


19 Sladkov. Sladkov had pictures of his yacht on Sladkov's phone, 


12:18 20 not just one picture, lots of pictures. Sladkov had 


21 pictures -- you heard this from Agent Hitchcock -- of his 


22 vacation in the Maldives in Sladkov's phone. Why? Do you have 


23 pictures of random other people's vacations that you don't know 


24 on your phone? 


25 Sladkov has his chat app, his super-secret encrypted 
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i chat app that even his own expert couldn't get into, on his 


2 phone. Sladkov has a proposal from his company a year before 
3 that product was announced on his phone. 
4 Sladkov and Ermakov are talking about trading in 


5 Kohl's, trading screenshots of what's going on in the market in 


6 Kohl's, on the very same day that Sladkov and the defendant are 


7 trading in Kohl's, after a download, before the news is public. 


8 Sladkov and the defendant and Sladkov's buddy, Irzak, 


9 trade in the same direction on the same stock over and over and 


12:19 10 over and over again, and 97 percent of the time when they'r 


11 trading the same stocks, they're trading in exactly the same 


12 direction. It's Exhibit 255. That alone is devastating 


13 evidence of the conspiracy. 


14 And, of course, it's the same Julie Soma user ID 


LS that's used to get that information over the 104 IP. All those 


16 different companies over the 104 IP who had their earnings 


Ly downloaded, Sladkov and the defendant trade on those companies 


18 in the same direction at the same time, after the information 


19 is downloaded over an IP that's right here in Boston. 133 


12:20 20 earnings releases are downloaded over the 104 IP right here in 


21 Boston, and Sladkov and the others and the defendant trade ona 


22 bunch of those stocks. 


23 You'll also learn that whether they knew each other, 


24 of course, doesn't matter. It's not necessary to prove that 


25 all the conspirators knew each other, and, frankly, you don't 


12:20 10 


12:21 20 


21 


22 


23 


24 


25 
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even have to find that Sladkov was part of the conspiracy. All 


you have to find —- 


MR. FERNICH: Objection, objection. 


MR. FRANK: —- is that he -- 


COURT: I'll give you the law. Thank you. 
FRANK: -—- he conspired with one other person. 


FERNICH: Objection. 


COURT: We'll deal with that later. 


MR. FRANK: And somebody took a single step in 


furtherance of it. 


There was a challenge to Mr. Clarke's testimony, that 


he only looked at what we asked him to look at; he only looked 


at 


the dates that the government asked him to look at. Well, 


submit to you that Mr. Clarke's testimony is essentially 


unchallenged, that there's a one-in-a-trillion chance that this 


man would trade the way he did i there was no relationship 


between his trading and the identity of the filing agent, there 


is 


a one-in-a-trillion chance that he would trade long where 


there were earnings surprises and short there were earnings 


surprises on the downside, if there was no relationship between 


those two things. There's a few-in-a-million chance that he 


would trade the way he did if there was no relationship between 


DF 


the time of his trade and when there was a download from the 


IN servers. You've heard no serious challenge to any of 


that. 
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1 But that brings me to Mr. Tawil. Poor Mr. Tawil. 


2 Well, not so poor, Mister 30K. You heard counsel talk about 


3 that tweet from Elon Musk and how that could have driven stock 


4 prices. Mr. Tawil told you about that, except he didn't know 


5 that the tweet was months after the defendant's trading in an 


6 earnings announcement. Mr. Tawil, the man who came in here to 
7 talk about documents he knew nothing about and didn't bother to 
8 check, whose source he didn't even know, who didn't even want 


9 to stand by his own expert report. And, of course, the 


12:22 10 documents he did testify about weren't accurate. 

11 Members of the jury, the defense has no obligation to 
12 put on a case, none. They can sit here and put us to our 

13 burden of proof. But when they do put on a case, you have the 


14 right to examine it. Their first witness, Mr. Roberts, 


15 confirmed that when hackers behave the way the hackers behaved 


16 here, united by common IP addresses and common VPN services and 
Ay common behavior, that suggests that they are acting as a group. 


18 And their second expert witness, Mr. Tawil, showed you how 


19 desperate the defendant is to get away from the numbers, from 


12:23 20 his own trading record, because his trading record is 


ZA devastating evidence of his fraud, when it started, when it 


22 stopped, and the concentration in the earnings announcements of 


23 DFIN and Toppan Merrill clients. 
24 And that brings me to venue. The defendant wants you 


25 to believe that he didn't do it and Ermakov didn't do it, and 
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al if anyone did it, it was Sladkov; but whatever you believe, he 


2 wants you to think it didn't have anything to do with Boston. 


3 This is grasping at straws, members of the jury, trying to 


4 confuse because there is no defense to the crime itself. 


5 The Judge will instruct you that for the conspiracy 


6 count, all we have to prove is that it is more likely than 


7 not —- it's a different standard that applies to venue, it is 


8 not beyond a reasonable doubt -—- all we have to prove is that 


9 it is more likely than not that the offense began outside the 


12:24 10 United States, that the essential conduct of the conspiracy 


Li took place outside the United States, and that the defendant 


12 was first brought to Boston after he was arrested in 


13 Switzerland. That point is not even disputed. 


14 There's a stipulation in evidence. He was brought 


15 straight to Boston after his arrest in Switzerland. And you 


16 know that the agreement began outside the United States in 


17 Russia where all the conspirators live. And you know that 


18 everything they did to set this conspiracy in motion, they did 


19 from Russia. In fact, the crime of conspiracy was complete in 
12:24 20 Russia. 


21 . FERNICH: Objection. 


22 . FRANK: All they had to do was -—- 


23 . FERNICH: Objection. 


24 COURT: Overruled. 


25 . FRANK: —- was take one overt act after that 
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1 agreement was made, and the crime of conspiracy was complete. 


2 And there were dozens of overt acts. Every single time 


3 somebody sat down at a computer to hack into DFIN and Toppan 


4 Merrill, that was an overt act. Every single time someone sat 


5 down at a computer or picked up their phone to trade on the 
6 SaxoTraderGo app, or any one of the other brokerage accounts, 


7 that was an overt act in furtherance of the conspiracy. So 


8 that is venue for the conspiracy. 
9 For the other counts, all you need to find is that 


12:25 10 it's more likely than not that some essential conduct happened 


11 here. That's why we spent so much time talking about the 104 


12 [P, the 104 IP that they now claim you have no evidence that it 


13 was in Boston. Members of the jury, where were they? You have 


14 so much evidence about this one IP address. 


15 Mr. Wall they claim was making it up. That's 


16 essentially their argument: It wasn't on the StrongVPN 


Ly website, even though Mr. Wall told you he didn't know how often 


18 that website was updated, and, in any event, it didn't matter 


19 because those IP addresses were used across the various brands 


12:26 20 that StackPath had, including companies like IPVanish. 


21 Mr. Wall told you that that IP address was up and 


22 running the minute they got it on May 30th of 2018, and Aditi 


23 Shah corroborated that. She told you the same thing, and you 


24 saw the documents where she notified Cogent, "We want to put 


25 this IP address in Boston," and asked Cogent to direct the 
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1 internet traffic here. And you saw the response from Cogent, 


2) "Done," May 30, 2018. And then you saw the invoices from 


3 months later, in November and December of 2018, billing 


4 StackPath for that IP address in Boston. And you saw the 


5 picture of the computer server in Boston as of September, 2018, 


6 where that IP address resided. And, yes, there were other IP 


i addresses also on that server because you heard evidence that 


8 many IP addresses can reside on a single server. 


9 There is abundant evidence, way, way, way more likely 


12:27 10 than not, I submit to you, that that IP address was in Boston 


Li at the relevant time. It is conclusive evidence, and it is 


12 from that computer, that IP address, just a few blocks from 


13 this courthouse, that 133 earnings reports were downloaded 


14 using Julie Soma's user ID from DFIN. That is the deceptiv 


15 device, using Julie Soma's identity to get into DFIN and get 


16 access to those earnings reports. That's the deceptive devic 


17 for securities fraud. That's the essence of that crime, and it 


£ 


18 happened from here in Boston. That's the wire for the wire 


19 fraud. That's the unauthorized access for the charge of 


12:28 20 unauthorized access, and it happened as to those 133 earnings 


21 announcements from right here in Boston. And you know that the 


22 defendant and Sladkov and the others traded in so many of those 


23 stocks that were downloaded from right here in Boston in 


24 October and November of 2018. 


25 That gives you venue over Counts 2, 3, and 4, and it 
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1 gives you another ground for venue over Count 1. And, 
2 remember, this is not beyond a reasonable doubt. This is only 


3 more likely than not. 


4 I'm going to wrap up, ladies and gentlemen, because 


5 know you're hungry and you've heard a lot of speaking. You 


6 walked into this courthouse with your common sense and you will 
7 leave it with your common sense, and in between you will take 

8 that common sense with you into the jury room for your 

9 deliberation, because common sense is all you need to decide 


12:29 10 this case. 


11 There was a hack. He ran a hacking company. The 
12 addresses associated with the hack lead back to his hacking 


13 company and his close friends. He traded in the shares of the 


14 company whose earnings information was stolen. He made a 


15 fortune, and he stopped making money when the hackers were 


16 locked out. He did it. He did it using an IP right here in 


£ 


17 Boston just a few blocks from this courthouse. That was part 


18 of the scheme, and the evidence is overwhelming, mountains and 


19 mountains of evidence. He is guilty beyond a reasonable doubt, 


12:30 20 exactly as charged. Thank you for your time. 


21 THE COURT: We stand in recess. AS soon as you're 


22 done with lunch, which I hope is there -- we'll monitor it -- 


£ 


23 we'll come back in, but not a 


ull hour. We're hoping to sort 


£ 


or lunch as well and then come 


24 of give counsel the opportunity 


25 back here. You know, I'm hoping 1:00 o'clock, give or take. 
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1 She's going to check out the food. Otherwise, she'll make the 
2 sandwiches, right? 

3 (Laughter. ) 

4 (Jury excused.) 


5 THE COURT: Can I see counsel at sidebar 


6 second. 


7 SIDEBAR CONFERENCE: 


8 THE COURT: Do we need the white noise on? I think we 


9 have some press back there. 


12:31 10 So let me say, there were two objections Mr. Fernich 


11 made which I'm not sure I totally understood, but if it's the 


12 issue of whether or not Mr. Sladkov was involved with the 


13 conspiracy or not, the sanitized indictment doesn't do much. 


14 In other words, the unindicted, unnamed coconspirators were 


15 nentioned in the rest of it. So I don't think what -- and 


16 naybe I'm wrong but I'm just -- I don't think what Mr. Frank 


ay said is wrong. They only need to prove the conspiracy, 


18 Klyushin, Ermakov, and Rumiantcev. That's all they need to 


19 prove beyond a reasonable doubt is an understanding between 


12:32 20 them. So I wasn't sure I understood your objection. 


21 MR. FERNICH: They have to prove a single conspiracy 


22 charged in the indictment. 


23 THE COURT: Right, I hear that, but they're never 


24 going -- 


25 . FE : I wouldn't send it back. TI don't think 
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A it's necessary. I think your Honor would avoid this problem by 


2 not sending it back. Your Honor is going to instruct them and 
3 summarize —— 


4 (Cross-talk.) 


5 MR. FERNICH: I don't remember what I said. Oh, so 


6 your Honor is going to instruct and summarize the indictment, 
7 and if they want it, they can ask for it. 


8 THE COURT: I think I'm not going to send it in. 


9 MR. FERNICH: Yes, I think not. 


12:33 10 THE COURT: It's confusing. They don't know what 


11 you're talking about. 


12 MR. FERNICH: It's a real speaking indictment. 


13 There's too much to —-- 


14 THE COURT: Okay. Next one. 


15 MR. NEMTSEV: Were there any other objections to the 


16 jury instructions? 


ike) MR. FERNICH: He thinks there's a special preservation 


18 requirement here, so for the record, we just reiterate 


£ 


19 everything that was previously lodged in terms o 


objections. 


12:33 20 THE COURT: I have no idea what you just said. 


21 Objections to the -—- I heard no objections -—- 


22 MR. FERNICH: No, just everything -- formally, to the 


23 extent that we have to, we just formally, without elaborating, 


24 renew every charge objection. 


25 THE COURT: Can I say, you can't do that. 


Case 1:21-cr-10104-PBS Document 218 Filed 02/21/23 Page 97 of 153 


10-97 


ac i : IT can't? Okay. No, we don't have to do 


3 THE COURT: Let me put it this way: When 


4 with the charge, at that point you preserve. 


5 MR. FERNICH: All right. 


6 THE COURT: Okay? There was another objection, but 


i do think Mr. Frank was right that the overt -—- that the 


8 conspiracy was complete, or could have been complete, if there 


9 was an agreement and an overt act in Russia. 


12:34 10 MR. FERNICH: If there was an overt act, yeah, and 


Aad. then he added that afterward. 


12 THE COURT: I just wanted to make sure -—- you know, we 


13 had a long day -- that I'm understanding it. Enjoy, have a 


14 wonderful lunch, and then I'll bore everyone to tears and just 


15 read this instruction, and then you will preserve. All right. 


16 In the meantime, let me just ask, are the two 


17 paralegals going to be assisting to make sure that the 


18 documents are all in good shape to go back? 


19 MR. KOSTO: Yes. 


12:34 20 THE COURT: Okay. I plan on leaving here around 4:00 


21 today. They may have to leave a little on the early side, but 


22 it's my practice to send them home. In other words, I'll see 


23 them when they go home. And I'm sort of going to assume that 


24 if you're all here, the defendant should be here. If you don't 


25 all want to be here, none of you should be here to say good 
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2 MR. FRANK: Okay. We'll be here. What's your 


3 pleasure, your Honor? 


4 MR. FERNICH: This is home for them. 


5 THE COURT: My point is only, I say "good-bye." 


6 don't just dismiss them out of the courtroom. I say "good-bye" 
7 and remind them not to talk about the case or look at social 
8 media, dah-dah-dah. So do you all want to be here? Think 


9 about it. 


12:35 10 THE CLERK: If there's a question, Judge, don't forget 


11 I need numbers -- 


12 THE COURT: My charge that is going to put everyone to 
13 sleep is coming next. 


14 MR. FERNICH: What time do you want to start here? 


15 THE COURT: I'm going to say 1:00. It's my practice 


16 to send back a transcript of the charge as soon as it's 


17 available, so Monday morning some time, and I'll ask you to 


18 proof it to make sure. 


19 (End of sidebar conference.) 


01:11 20 (A recess was taken, 12:36 p.m.) 
21 (Resumed, 1:11 p.m.) 
22 (Jury enters the courtroom.) 
23 THE COURT: The jury shall remain standing. Everybody 
24 else in the courtroom shall be seated. Thank you. 


25 
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1 JURY INSTRUCTIONS 


2 THE COURT: Good afternoon. There's an old tradition 


3 in the courts of our Commonwealth and in this Federal Court 


4 that at this stage of the proceeding, the judge stands and 


ag 


5 faces the jury and the jury faces the Judge. This is the best 


6 way that I know how to symbolize the important role we both 
7 play at this trial. 
8 My job has been threefold: First, my job was to 


9 impanel a fair and impartial jury. You are that fair and 


01:12 10 impartial jury. You swore to be fair and impartial, and you've 


‘lal been amazing at showing up on time and paying attention. On 


12 behalf of everyone in this room, we thank you for your service. 


13 The second job was to rule on evidentiary objections 
14 and make certain rulings of law, and now my third and final 


LS task is to give you these instructions of law. You must follow 


16 these instructions whether you agree with them or not. To the 


A} extent I say something differently from what the attorneys say, 


18 you shall follow these instructions of law. 


19 These instructions will be divided into three parts. 


01:12 20 The first part is very general but extremely important. It 


21 will set forth the constitutional principles that govern this 


22 case, and I remind you that all of you swore that you could 


23 follow these constitutional principles. In addition, it will 


24 go through what are Rules of Evidence and what are the 


25 differences between openings and closings and that sort of 
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2 The middle portion of the charge is very specific to 


i) the specific crimes with which Mr. Klyushin has been charged, 


4 and I gave you a verdict form. I will be going through the 


5 elements that must be proven beyond a reasonable doubt. 


6 And my third and final task will be what I call the 


7 "mechanics" of getting this case out to you to deliberate, 


8 about choosing a foreperson, about the role of alternates, 


9 about deliberations. 


01:13 10 Now, at this point I am going to encourage you to 


11 least take some barebones notes about this charge. Please 


12 don't take it all down. It's impossible. It's very long and 


13 really boring, but it's important, okay, for you to follow. 


14 It's not as exciting as what you heard this morning, but it's 


15 important for you to follow the law. 


16 In order to make sure you get it correctly, I have an 


LS) old-fashioned tape recorder playing right here, which I will 


18 bring back into the jury room, and on Monday you'll have a 


19 transcript of the full charge. But the only reason I ask you 


01:14 20 to take notes is so you can remember exactly where in the 


21 charge I may have discussed a particular issue. But don't try 


22 and transcribe everything that I say. You'll get it, both on 


23 the tape recording and in the transcript. 


24 All right, so let's sit down and get going. 


25 Let me begin with the role of the Court. These 
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] instructions are about the law you must apply. I don't mean 


2 any of my instructions to be understood by you as a comment by 


Ea 


3 me on the facts or on the evidence in the case. You are the 


4 judges of the facts and the sole judges of the credibility of 


5 the witnesses. You must be guided only by my instructions on 


6 the law as I state them. You should consider them as a whole. 


7 I may repeat some portions, but that does not mean that they 
8 are more important. All the instructions are equally 


9 important. 


01:15 10 Even if you disagree with some of the rules of law or 


11 don't understand the reasons for them, you are bound to follow 


12 them as jurors in this case. This is a fundamental part of our 


13 system of government by law rather than by the individual views 
14 of the judge and jurors who have responsibility for deciding a 


LS specific case. 


16 To the extent I say something differently from what 


17 the attorneys said, follow my instructions of law. However, I 


18 am not the judge of the facts. I have no opinion as to the 


19 appropriate outcome of the case. You must disregard any facial 


01:16 20 expressions you think I might have had. Also, if during the 


21 course of these instructions, or at any other time, I have 


22 stated the evidence differently than you remember it, you must 


23 disregard my memory of the evidence. It is your memory that 
24 counts. 


25 What is your job as the jury? Your function as jurors 
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ac is to determine the facts. You are the sole and exclusive 


2 judges of the facts. You decide the weight, effect, and value 


Si of the evidence. You also decide the credibility or 


4 believability of the witnesses. Once you determine the facts, 


5 it is your duty to apply those facts to the law as I explain 


6 it. You must decide whether the defendant is guilty or not 


7 uilty of the charges that the United States has brought 
8 against him. 


£ 


9 You must determine the facts without prejudice, fear, 


01:17 10 favor, bias, or sympathy. You also may not consider any 


11 personal feelings you may have about the race, religion, 


12 national origin, sex, or age of the defendant, or any witness 


£ 


13 who testified during trial. You must determine the facts 


To 


14 solely from a fair consideration of the evidence. 


you were 


iS) to allow prejudice, fear, favor, bias, or sympathy to enter 


16 into your deliberations, there's a great risk that you will not 
17 arrive at a true and just verdict. 


18 The issue before you is not whether you are for or 


19 against the crime charged. Rather, the issue is whether the 
01:17 20 government has proven beyond a reasonable doubt that the 


21 defendant is guilty of the crime charged. 


22 You should also not be influenced by the fact that the 


23 United States of America has brought this case. All parties, 


- 


24 the government and Mr. Klyushin, stand as equals before the 


25 Court. So when you go back to the jury room, the question must 
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1 never be, will the government win or lose this case? You 


2 represent the people of the United States, and the people of 
i) this country always win when justice is done. 


4 You are not to decide the case based on what you may 


5 have heard or read outside the courtroom. You cannot speculate 


6 or guess as to what might or might not have happened. You 


7 cannot allow yourselves to be influenced by your view of the 


8 nature of the crimes with which the defendant has been charged 


9 or the consequences of the verdict. Instead, you must confine 
01:18 10 your deliberations to the evidence and nothing but the 
11 evidence. 


12 The lawyers were allowed to comment during the trial 


13 both on the evidence and the rules of law, but if what they say 


14 about the evidence differs from your memory, let your 


LS collective memory control. And if what they have said about 


16 the law seems to you to have a different meaning in any way 


17 from my instructions on the law, be guided by these instructions. 


18 What is evidence? We discussed this briefly way back, 


19 but we're going to go through it now. The evidence from which 


01:19 20 you are to decide what the facts are consists of sworn 


21 testimony of witnesses, both on direct and cross-examination, 


22 regardless of who called the witness, and the exhibits that 


23 have been received in evidence. 


24 You are not limited solely to what you see and hear as 


25 the witnesses testify. You are permitted to draw from facts 
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1 you have found to have been proven such reasonable inferences 


2 you believe are justified in light of common sense and personal 
3 experience. 


pi 


4 The mere number of witnesses, the length of the 


PY ag 


5 testimony, or the number o 


exhibits have no bearing on what 


6 weight you give to the evidence or whether you find the 
- government's burden of proof has been met. Weight does not 


£ 


8 mean the amount of the evidence. Weight means your judgment 


9 about the credibility and importance of the evidence. 


01:20 10 Certain things are not evidence. Opening statements 


11 that you heard, the closing arguments you heard today made by 


12 the lawyers are not evidence in the case, nor are the questions 


13 of counsel evidence. Only the witness's answers are evidence. 


14 Questions that were not answered or to which objections were 


15 sustained also are not evidence in the case. The function of 


16 the lawyers in making their arguments is to point out those 


17 things that are most significant or most helpful to their side 


18 of the case, and, in so doing, to call your attention to 


19 certain facts or inferences that might otherwise escape your 


01:21 20 notice. In the final analysis, however, it is your own 


21 recollection and interpretation of the evidence that controls 


22 in the case. 
23 At times during the trial -- at many times during the 
24 trial, you heard the lawyers make objections to guestions asked 


25 by the other lawyers or to the answers by the witnesses. This 
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1 simply meant that the lawyers were requesting that I make a 


££ 


2 decision on a rule o 


law. Don't draw any conclusion from such 


3 objections or my rulings on them. These rulings only relate to 


4 the legal questions that I had to determine and should not 


5 influence your thinking. When I -- you know this by now, but 


6 when I sustained an objection to a question, the lawyer (Sic) 


7 was not allowed to answer it, and don't try to guess what might 


8 have been the answer had I allowed the question to be answered. 


9 Similarly, when I told you not to consider a particular 


01:21 10 statement -- maybe someone flipped it in before I could rule —- 


11 because I struck it, you were told to put that statement out of 


12 your mind, and you may not refer to that statement in your 


13 deliberations. 


14 Also, if I received evidence but told you it was 


15 received for a limited purpose remember several times 


16 interjected and I said, you know, "I'm limiting what you can do 


17 with this" -—- or if I tell you now that you can only use some 


18 of the evidence in a particular way, consider those 


19 instructions, and you are bound by that limitation. 


01:22 20 During the trial I occasionally may have made comments 


21 to the lawyers, asked questions of a witness, or admonished a 


22 witness concerning the manner in which he should respond to 


23 questions or counsel. Do not assume from anything I may have 


24 said that I have an opinion concerning any of the issues in 


25 this case. Except for my instructions to you on the law, you 
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1 should disregard anything I have said during the trial in 


2 arriving at your own findings of the facts. 


Si I want to go through again what the difference is 


4 between direct and circumstantial evidence. There are two 


5 types of evidence which you may use to determine the facts of 


6 the case: There's direct evidence and circumstantial evidence. 


7 Direct evidence is direct proof of a fact, such as the 


8 testimony of an eyewitness that the witness saw something. 


9 Circumstantial evidence is indirect evidence; that is, it is 


01:23 10 proof of a fact or facts from which you could draw the 


1] inference, by reason and common sense, that another fact 


12 exists, even though it has not been proven directly. Any 


13 inferences or conclusions that you draw must be reasonable and 


14 natural, based on your common sense and experience of life. In 


15 a chain of circumstantial evidence, it is not required that 


Se 


16 each one of your inferences and conclusions be inevitable, but 


Ay it is required that each one of them be reasonable. 


18 Direct and circumstantial evidence have equal standing 


19 in the law. That is, with respect to what weight shall be 


01:23 20 given to the evidence before you, the law makes no distinction 


21 between direct and circumstantial evidence. Also, no greater 


22 degree of certainty is required of circumstantial evidence than 


23 that of direct evidence. In reaching your verdict, it is 


24 permissible to draw and rely upon inferences from the evidence. 


25 You are to consider all the evidence in this case and give each 
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il item of evidence the weight you believe it deserves. 


2 Whether the evidence is direct or circumstantial, the 


= 


3 government must prove the defendant's guilt beyond a reasonable 


4 doubt from all the evidence in the case. 


5 I would like to now address the issue of credibility 


6 of witnesses. As jurors, your function is to evaluate the 


7 exhibits that have been introduced and determine the 


8 credibility of the witnesses' testimony. "Credibility" is 


£ 


9 Simply another word for believability. It is your function to 


01:24 10 determine the believability of the witnesses who testified. 


11 You're free to decide that you believe all of what a witness 
12 told you, none of what a witness told you, or some of what a 
13 witness told you. You are free to do so in accordance with 


14 your collective judgment as to the believability of what it was 


15 that the witness told you while testifying. 


16 Neither I nor anyone else can tell you all of the ways 


17 that you go about making this important judgment about 


18 credibility. That's why we have you, the jury. However, I can 


19 suggest to you some of the things that you should consider in 


01:25 20 making that judgment as to credibility. You should consider 


21 the conduct and demeanor of the witness while testifying; how 


22 the way the witness testified on direct compared to how he 


£ 


frankness that the 


23 testified on cross; the frankness or lack of 


24 witness showed while testifying; the reasonableness or 


25 unreasonableness of the witness's testimony; the probability or 
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il improbability of that testimony; the opportunity or lack of 


2 opportunity that the witness had to see and know the facts 


3 about which he or she was testifying; the accuracy of the 


4 witness's recollection; the degree of intelligence shown by the 


BY ag 


5 witness; the witness's prior conduct for truthfulness; and 


6 whether the witness has attempted to fill in gaps in his memory 


7 of events with information he or she obtained after the event. 


8 You may also consider whether the witness has a motive 
9 for testifying and the interest or lack of interest that the 


01:26 10 witness may have in the outcome of the case. You may take into 


11 consideration the character and the appearance of the witness 


12 at trial and any bias he or she has shown in his testimony. 


££ 


13 This list is not exhaustive but rather a list of examples of 


14 the factors you may take into account, and should take into 


15 account, in making a credibility judgment. 


16 You may consider inconsistencies in the evidence or 


17 differences as you weigh evidence, but you do not have to 


18 discredit testimony solely because there are inconsistencies 


19 differences in the testimony of a witness or between the 


01:26 20 testimony of different witnesses. Two or more persons 


21 witnessing an incident or a transaction may see or hear it 


22 differently. In weighing the effect of any inconsistency or 


23 difference, you may consider whether it concerns a matter of 


24 importance or an unimportant detail and whether it results 


25 innocent error or intentional falsehood. 
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i You are not required to accept testimony, even if it 


2 is uncontradicted. You may decide, because of the witness's 


3 bearing and demeanor, or because of inherent improbability, or 
4 other reasons sufficient to you, the testimony is not worthy of 


5 belief. 


6 Let me talk to you for a minute about law enforcement 


7 agents. You have heard the testimony of law enforcement 


8 officials. The fact that a witness may be employed by the 


9 federal government as a law enforcement official does not mean 


01:27 10 that his or her testimony is necessarily deserving of more or 


11 less consideration or greater or lesser weight than that of an 


12 ordinary witness. It is your decision, after reviewing all the 


13 evidence, whether to accept the testimony of the law enforcement 


14 witness and to give that testimony whatever weight, if any, you 


is) find it deserves. 


16 It is also appropriate to consider whether, in his or 


17 her investigation, the particular law enforcement witness acted 


18 in accordance with the standards of the department or agency. 


19 If you find any omissions in the investigation were significant 


01:28 20 and not adequately explained, you may consider whether the 


21 omissions tend to affect the quality, reliability, or 


22 credibility of the evidence presented by the government. 


23 Now, I just finished what I'll call the very broad 


24 evidentiary instructions. Let's stand up and stretch because 


25 I'm about to hit the very important area of the constitutional 
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] principles here. 


2 (Pause. ) 
3 THE COURT: All right, let's hit the Constitution. 


4 Let's go, the constitutional principles. Let's begin with the 


5 presumption of innocence. It is a cardinal principle of our 


6 system of justice that every person accused of a crime is 


7 presumed to be innocent unless and until his guilt is 


8 established beyond a reasonable doubt. This presumption is not 


9 a mere formality. It is a matter of the most important 
01:29 10 substance. 


‘lal The presumption of innocence alone may be sufficient 


12 to raise a reasonable doubt and to require the acquittal of the 
13 defendant. The defendant before you has the benefit of that 


14 presumption throughout the trial, and you are not to convict 


15 him of a particular charge unless you are persuaded of his 
16 guilt of that charge beyond a reasonable doubt. 


17 The presumption of innocence until proven guilty means 


18 that the burden of proof is always on the government to satisfy 


19 for you that the defendant is guilty of the crimes with which 


01:30 20 he is charged beyond a reasonable doubt. It is a heavy burden, 


21 but the law does not require that the government prove guilt 


22 beyond all possible doubt. Proof beyond a reasonable doubt is 
23 sufficient to convict. 


24 This burden never shifts to the defendant. It is 


25 always the government's burden to prove each of the elements of 
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1 the crimes charged beyond a reasonable doubt by the evidence 


2 and the reasonable inferences to be drawn from the evidence. 


3 The defendant has the right to rely upon the failure or 


4 inability of the government to establish beyond a reasonable 


5 doubt any essential element of a crime charged against him. 


6 If, after fair and impartial consideration of all the 


7 evidence, you have a reasonable doubt as to the defendant's 


8 guilt of the crime charged, it is your duty to find him not 


9 guilty of that crime. 


01:30 10 On the other hand, if, after fair and impartial 


11 consideration of all the evidence, you are satisfied beyond a 


12 reasonable doubt of the defendant's guilt of the crime charged, 


13 you should vote to convict him. 


14 What is the burden of proof? The United States has 


15 the burden of proving beyond a reasonable doubt that the 


16 defendant is guilty of the crime charged by the indictment. 


LS] This burden of proof rests on the United States and never 


18 shifts to the defendant. The defendant is not required to 


19 prove anything to you or to present any evidence. Because of 


01:31 20 the constitutional right to the presumption of innocence, the 


21 government has the burden of proof beyond a reasonable doubt on 


22 every essential element of the crime charged. 


23 What is proof beyond a reasonable doubt? What is 


24 proof beyond a reasonable doubt? Reasonable doubt is a doubt 


25 based on reason and common sense. The law does not require 
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21 


22 


23 


24 


25 
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le doubt —-- 


little in life can be proven to an absolute certainty -- but 


the law does require that the government prove each of the 


elements of the crime charged beyond a reasonable doubt. 


It is not sufficient 


probability, though a strong one, that an element of 


for the government to establish 


a crime 


charged is more likely to be true than not true. That is not 


enough to meet the government's 


reasonable doubt. A reasonable 
the evidence produced, but also from a lack of evidence. Of 


course, a defendant never is to 


or conjecture. 


heavy burden of proof beyond 


doubt may arise not only from 


be convicted based on suspicion 


If after a fair and impartial consideration of all of 


the evidence you have a reasonable doubt, it is your 


acquit. On the other hand, 


duty to 


if after fair and impartial 


consideration of all the evidence you are satisfied that the 


government has proven each of the el 


beyond a reasonable doubt, you should vote to convict 


lements in the indictment 


It is not necessary for you to conclude that the 


defendant is factually innocent in order to return a "not 


guilty" verdict. A "not guilty" verdict means only that the 


prosecution has not met i 


its burden of proving the defendant 


guilty beyond a reasonabl 


le doubt. 


Mr. Klyushin has not testified in this trial. It is 


the law of the United States that a defendant has an absolute 


01:34 10 
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The defendant is under no obligation or 


There are many reasons for not testifying, 


reasons that are quite consistent with innocence. Therefore, 


you are not to speculate or engage in conjecture as to those 


reasons, and, as 


have 


Said, you are to draw no adverse 


inference whatsoever from the defendant not testifying. If you 


were to do so, 


you would be doing our nation and our body of 


law a disservice and an injustice. Moreover, you would be 


violating your solemn oath as jurors. Once again, it is the 


burden of the United Sta 


charges beyond a reasonable doubt. 


whatsoever. 


punishment. 


Let me speak to you briefly about the 


The question of possible punishmen 


is of no concern to you, the jury, and should n 


enter into or influence your deliberations. Th 


£ 


01:34 20 


21 


22 


23 


24 


25 


whether or not the defendant 


imposing the sentence rests exclusively upon th 


£ 


doubt solely upon the basis of such evidence. 


as 


tes to prove all elements of the 


The defendant has no burden 


question of 


t of a defendant 
ot in any sense 
e duty of 


& Court. Your 


unction is to weigh the evidence in this case and to determine 


is guilty beyond a reasonable 


Under your oaths 


jurors, you cannot allow a consideration of the punishment 


which may be imposed upon the defendant, if he 


in 


del 


All right, 


now 


iberations in any sense. 


is convicted, to 


fluence your verdict in any way or enter into your 


I'm going to go into the specific 
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] instructions. Remember I told you there was a middle portion? 


2 And I'm going to go into the specific crimes that are alleged/ 


3 charged in the indictment. 


4 You've heard the term "indictment." I remind you that 


5 an indictment is not evidence of any kind against the 


6 defendant, Vladislav Klyushin. It's just an accusation ina 


7 document filed with the court to bring a criminal charge 


8 against a defendant. 
9 The number of charges against Mr. Klyushin is not 


£ 


01:35 10 evidence of guilt and should not influence your decision in 


11 this case in any way. It is your duty to separately consider 


12 the evidence that relates to each charge and to return a 
13 separate verdict for each one. For each charge, you must 


14 decide whether the government has presented proof beyond a 


15 reasonable doubt that Mr. Klyushin is guilty of that particular 


16 charge. You must consider them separately. Your decision on 


17 one charge should not influence your decision on the other 


18 charge. 


19 For each count, the government must prove several 


01:36 20 things, and those things that the government has to prove we've 


21 been referring to as "elements." You've heard that. The 


22 government must prove the elements of each crime beyond a 
23 reasonable doubt. You must give separate consideration to each 


24 of the counts and to the elements in each count. 


25 Also, you've heard evidence that certain acts occurred 


01:37 10 


01:37 20 


21 


22 


23 


24 


25 
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es. It does not matter if the 


a specific act occurred on or about a 


certain date and the evidence indicates that, in fact, it was 


on another date. The 1 


Similarity between the 


aw only requires a substantial 


dates alleged by the te 

All right, so 
verdict in front of you 
the government contends 
of conspiracy to obtain 


commit wire fraud or to 


In Count Two, 


committed wire fraud an 


In Count Three 


dates alleged in the indictment and the 


stimony or exhibits. 


—-— the different counts. In 


that Mr. Klyushin committed 
unauthorized access to compu 


commit securities fraud. 


I'm going to go through -- you have the 


Count One, 


the crime 


ters or to 


the government alleges that Mr. Klyushin 


d aiding and abetting. 


, the government alleges that 


Mr. Klyushin committed the crime of unauthorized access to 


computers and aiding an 


In Count Four, 


d abetting. 


the government alleges that 


£ 


Mr. Klyushin committed the crime of securities fraud 


and abetting. 


and aiding 


Mr. Klyushin has pled not guilty to these charges, and 


the government must therefore prove them all by proof beyond a 


reasonable doubt with r 


offense charged in the 


espect to all of the elements 


you can find Mr. Klyushi 


You've heard t 


of a given 


indictment against Mr. Klyushin before 


n guilty of that particular offense. 


he term "venue," and I'll be getting 
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1 into that in much greater detail. The government must also 


2 prove by a preponderance of the evidence that venue is proper 


3 in order for you to convict. 


4 So I'm going to Count One, conspiracy. 


5 What's a conspiracy? Count One charges Vladislav 


6 Klyushin with conspiring with Ivan Ermakov, Nikolai Rumiantcev, 


7 and others to commit federal crimes; specifically, the crimes 


8 of unauthorized access to computers with the intent to defraud, 


£ 


9 wire 


raud, or securities fraud. It is against federal law to 


01:39 10 conspire with someone to commit these crimes. 


11 The government does not have to prove that the 


12 defendant agreed to commit all three of these crimes in order 


13 for you to find him guilty of the conspiracy charge. The 


14 government must, however, prove that the defendant agreed to 


is) commit at least one of these three crimes, and you must 


16 unanimously agree on which one. You cannot find the defendant 


LS) guilty of conspiracy unless you unanimously agree that the same 


18 federal crime or crimes was the object of a conspiracy. So, in 


19 other words, you must all unanimously agree as to what crime or 


01:39 20 crimes were committed. It can't be six agreeing to one and six 


21 as to another. You have to be unanimous. 


22 For you to find the defendant guilty of conspiracy, 


23 you must be convinced that the government has proven each of 


24 the following things beyond a reasonable doubt: 


25 First, that the agreement specified in the indictment, 
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1 and not some other agreement or agreements, existed between at 


2 least two people to commit unauthorized access to computers 


3 with the intent to defraud, wire fraud, or securities fraud. 


4 T'll repeat that. 


5 First, that the agreement specified in the indictment 


6 and not some other agreement or agreements, existed between at 


a least two people to commit unauthorized access to computers 


8 with the intent to defraud, wire fraud, or securities fraud. 


9 Second, that the defendant willfully joined in that 


01:40 10 agreement. Second, that the defendant willfully joined in that 


11 agreement. 


12 And, third, that one of the conspirators committed an 
13 overt act in an effort to further the purpose of the 
14 conspiracy. 


15 A conspiracy is an agreement, spoken or unspoken. The 


16 conspiracy does not have to be a formal agreement or plan in 


LS) which everyone involved sat down together and worked out all of 


18 the details. It is not necessary to show that the participants 


19 directly, by spoken or written word, stated among themselves 


01:41 20 exactly what their object or purpose was, or exactly what the 


21 details of the scheme were, or exactly what means they would 


22 adopt to achieve their goals. A conspiracy is, by its very 


23 nature, usually secret in its origin and in its execution. 


24 Because of the secretive nature of the crime of conspiracy, the 


25 agreement between two or more people may be express or tacit. 
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] It is sufficient if the government demonstrates conduct 


2 evidencing a silent understanding to share a purpose to violate 


3 the law. 


4 Because a conspiracy by its very nature is often 


bs secret, neither the existence of the agreement nor the fact of 


6 the defendant's participation in it must be proved by direct 


7 evidence but may be proved by circumstantial evidence. 


8 Mere similarity of conduct among various people or the 


9 fact that they may have associated with each other or discussed 


01:42 10 common aims and interests does not necessarily establish proof 


11 of the existence of a conspiracy, but you may consider such 


12 factors. 


13 To act willfully means to act voluntarily and 


og 


14 intelligently and with the specific intent that the underlying 


15 crimes of unauthorized access to computers, wire fraud, or 


16 securities fraud be committed. And I'll be instructing you on 


17 those later, but you have to have the specific intent that the 


18 underlying crimes of unauthorized access to computers, wire 


19 fraud, or securities fraud be committed. That is to say, the 


01:42 20 government must prove that the defendant acted with bad 
21 purpose, either to disobey or disregard the law, not to act by 
22 ignorance, accident, or mistake. 


23 The government must prove two types of intent beyond a 


24 reasonable doubt before the defendant can be said to have 


25 willfully joined the conspiracy: an intent to agree and an 
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1 intent that the underlying crimes be committed. Mere presenc 


2 at the scene of a crime, even when combined with knowledge that 


3 the crime will be committed, is not alone enough, but you may 


4 consider it among other factors. 


5 Intent may be inferred from the surrounding 


6 circumstances. Proof that the defendant willfully joined in 


- the agreement must be based upon evidence of his own words 


8 and/or actions. You need not find that the defendant agreed 


9 specifically to or knew about all the details of the crime, or 


01:43 10 knew every other coconspirator, or that he participated in each 


11 act of the agreement, or played a major role, but the 


12 government must prove beyond a reasonable doubt that he knew 


13 the essential features and general aims of the venture. 


14 Even if the defendant was not part of the agreement at 


15 the very start, he can be found guilty of a conspiracy if the 


16 government proves that he willfully joined the agreement later. 


LS) On the other hand, a person who has no knowledge of the 


18 conspiracy, but simply happens to act in a way that furthers 


19 some object or purpose of the conspiracy, does not thereby 
01:44 20 become a conspirator. 
21 The third element that the government must prove is 
22 that one of the conspirators committed an overt act to further 


23 the purpose of the conspiracy. An overt act is any act 


24 knowingly committed by one or more of the conspirators in an 


25 effort to accomplish some purpose of the conspiracy. Only one 
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1 overt act has to be proven. The government is not required to 


2 prove that the defendant personally committed or knew about the 


3 overt act. It is sufficient if one conspirator committed one 


4 overt act at some time during the period of the conspiracy. 
5 The overt act need not be illegal. 
6 The government does not have to prove that the 


- 


7 conspiracy succeeded or was achieved. The crime of conspiracy 


8 is complete upon the agreement to commit the underlying crime 


9 and the commission of one overt act. 


01:45 10 Whether there existed a single unlawful agreement or 


11 many such agreements, or indeed no agreement at all, isa 


12 question of fact for you, the jury, to determine in accordance 


13 with the instructions I'm about to give you. 
14 When two or more people join together to further one 


15 common unlawful design or purpose, a single conspiracy exists. 


16 By way of contrast, multiple conspiracies exist when there ar 


17 separate unlawful agreements to achieve distinct purposes. 


18 The government must prove the existence of the 


19 conspiracy charged in the indictment. If you find that 


01:45 20 conspiracy charged does not exist, you cannot find the 


21 defendant guilty. This is so even though you find tha 


22 conspiracy other than the one charged in the indictment 


23 existed, even though the purposes of both conspiracies may have 


24 been the same, and even though there may have been some overlap 


25 in membership. 
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alt [f Mr. Klyushin acted in good faith, he cannot be 


2 guilty of the crime of conspiracy. If Mr. Klyushin had a 


3 good-faith belief that he was not violating the law, even if 


4 that belief was mistaken, he did not have the necessary intent 


5 to commit conspiracy or any of the crimes charged. In other 
6 words, with respect to all of the charges, not just the 


7 conspiracy that we're discussing now, good faith is simply 


8 inconsistent with the element of willfulness. 
9 While the term "good faith" has no precise definition, 


£ 


01:46 10 it means, among other things, an honest belief, a lack of 


11 malice, and lacking in intent to violate the law. A person who 


12 acts on an honestly held belief is not punishable merely 


13 because that honest belief turns out to be incorrect or wrong. 


14 The law subjects to prosecution and punishment only those 


LS people who act willfully and with an intent to violate the law. 


16 The burden is on the government to prove the required 


£ 


Ay intent and consequent lack of good faith beyond a reasonable 


18 doubt. Mr. Klyushin is under no obligation to prove good 


19 faith. 


01:47 20 Now I'm going to move on to Count Two which is wire 


21 I'm seeing after-lunch a little bit effects here. Why 


22 stand and stretch to make sure I'm holding you. 


23 (Pause.) 


24 THE COURT: I'm talking about wire fraud right now. 


25 I elevated the voice a bit just to wake you up. All 
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A right, there you are, got smiles. 


2 Count Two of the indictment charges Mr. Klyushin with 


Si wire fraud. For you to find the defendant guilty of wire 


4 fraud, you must be convinced that the government has proven 


5 each of the following things beyond a reasonable doubt: 
6 First, a scheme, substantially as charged in the 


7 indictment, to defraud or to obtain money or property by means 


8 of materially false or fraudulent pretenses. First, a scheme, 


9 substantially as charged in the indictment, to defraud or to 


01:48 10 obtain money or property by means of materially false or 


11 fraudulent pretenses. 


12 Second, the defendant's knowing and willing 


13 participation in the scheme with the intent to defraud. 


14 And, third, the use of wire communications in 


15 i tate or foreign commerce, on or about the date alleged, 


16 i therance of the scheme. 


A} Wire communications in interstate or foreign commerce 


18 include telephone communications, emails, Internet-based 


19 communications from one state to another, or between the United 


01:49 20 States and another country. 


21 A scheme includes any plan, pattern, or course of 


22 action. 
23 The term "defraud" means to deprive another of 


24 something of value by means of deception or cheating. A scheme 


25 to defraud is ordinarily accompanied by a desire or purpose to 
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1 bring about some gain or benefit to oneself or some other 


2 person or by a desire or purpose to cause some loss to some 


3 person. 


4 The term "money or property" includes confidential 


5 business information. The term "false or fraudulent pretenses" 


6 means any false statements or assertions that concern a 


7 material aspect of the matter in question that were either 


8 known to be untrue when made or made with reckless indifference 


9 to their truth and that were made with the intent to defraud. 


01:49 10 They include actual, direct false statements as well as 


11 half-truths and a knowing concealment of facts. 


12 The deception need not be premised upon spoken or 


13 written words alone. To meet its burden under the wire fraud 


14 statute, the government must prove beyond a reasonable doubt 


15 that the defendant knowingly and willfully participated in a 


16 scheme that involved the defendant or another involved in the 


Ay scheme misrepresenting his identity online to defraud or to 


18 obtain money or property like confidential business 


19 information. 


01:50 20 To satisfy its burden of proof that a fact or matter 


21 is material, the government is not required to show that the 


22 fact or matter in fact influenced or deceived the decision-maker 


23 to whom it was addressed. Rather, a fact or matter is material 


24 if it has a natural tendency to influence or is capable of 


25 influencing the decision-maker to whom it is addressed. 
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1 To act with intent to defraud means to act willfully 


_ 


2 and with the specific intent to deceive or cheat for the 


Bg 


3 purpose of 


= 


causing some 


inancial loss to another or to bring 


4 about some financial gain to oneself. Thus, if the defendant 


5 acted in good faith, he cannot be guilty of the crime. The 


6 burden to prove intent, as with all other elements of crime, 


7 rests with the government. 


8 Intent or knowledge may not ordinarily be proven 


9 directly because there's no way of directly scrutinizing the 


01:51 10 workings of the human mind. In determining what the defendant 


11 knew or intended at a particular time, you may consider any 


12 statements made or acts done or omitted by the defendant and 


13 all other facts and circumstances received in evidence that may 


14 aid in your determination of the defendant's knowledge and 


15 intent. You may infer, but you certainly are not reguired to 


16 infer, that a person intends the natural and probable 


17 consequences of acts knowingly done or knowingly omitted. It 


18 is entirely up to you, however, to decide what facts are proven 


19 by the evidence received during the trial. 


01:52 20 You've heard several times, and you saw that in the 


21 closings, the terms "aiding and abetting." What does that 


22 mean? What does to aid and abet mean? To aid and abet - 
23 And you'll notice that aiding and abetting comes with 


24 Count Two, Count Three, and Count Four involved also the 


25 allegation of aiding and abetting. 
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il To aid and abet means intentionally to help someone 
2 else commit a crime. To establish aiding and abetting, the 
3 government must prove beyond a reasonable doubt that someone 


4 else committed the charged crime, and that the defendant 


5 willfully participated in it as he would in something he wished 


6 to bring about. 


7 This means that the government must prove that the 


8 defendant consciously shared the other person's knowledge of 


9 the underlying criminal act, intended to help him, and 


01:53 10 willfully took part in the endeavor, seeking to make it 


11 succeed. The defendant need not perform the underlying 


12 criminal acts, be present when it is performed, or be aware of 


13 the details of its execution to be guilty of aiding and 


14 abetting. But a general suspicion that an unlawful act may 


15 occur or that something criminal is happening is not enough. 


£ 


16 Mere presence at the scene of a crime and knowledge that the 


LS) crime is being committed are also not sufficient to establish 


18 aiding and abetting. 


19 I think I'll move at this point on to Count Three. 


01:53 20 And, remember, all these counts have an aiding and abetting 


21 with it. I won't repeat that instruction. 


22 The defendant is charged in Count Three of the 


23 indictment with computer fraud. For the defendant to be found 


24 guilty of that charge, the government must prove each of the 


25 following elements here we are going through the elements 
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1 again -—- beyond a reasonable doubt. All right, what does the 
2 government have to prove? 


3 First, that the defendant, or someone he aided and 


4 abetted, knowingly accessed without authorization a computer 


5 used in or affecting interstate or foreign commerce or 


6 communication. First, that the defendant, or someone he aided 


7 and abetted, knowingly accessed without authorization a 


8 computer used in or affecting interstate or foreign commerce or 


9 communication. 


01:54 10 Second, the defendant did so, or aided and abetted 


1 another's doing so, with the intent to defraud. Second, that 


12 the defendant did so, or aided and abetted another's doing so, 
13 with the intent to defraud. 


14 Third, by accessing the computer without 


15 authorization, the defendant, or someone he aided and abetted, 


16 furthered the intended fraud. Third, by accessing the computer 


17 without authorization, the defendant, or someone he aided or 


18 abetted, furthered the intended fraud. 


19 And, fourth, that the defendant, or someone he aided 


01:55 20 and abetted, by accessing the computer without authorization 


21 obtained something of value. Fourth, that the defendant, or 


22 someone he aided and abetted, by accessing the computer without 
23 authorization obtained anything of value. 
24 A person uses a computer without authorization when a 


25 person accesses a computer without any permission at all. A 
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1 computer used in or affecting interstate and foreign commerce 


2 includes computers connected to the Internet. 


3 To act with intent to defraud means to act willfully 


ps 


4 and with the specific intent to deceive or cheat for the 


5 purpose of either causing some financial loss to another or to 


6 bring about some financial gain to oneself. You may consider 


i any statement made or acts done or omitted by the defendant and 


8 all of the facts and circumstances received in evidence that 


9 nay aid you in determination of the defendant's knowledge or 


01:56 10 intent. You may infer, but you are certainly not reguired to 


1] infer, that a person intends the natural and probable 


12 consequences of his acts knowingly done or knowingly admitted. 


13 Finally, Count Four, securities fraud. 


14 In order to find the defendant guilty of securities 


15 fraud, you must find that the government has proven each of the 


16 following elements beyond a reasonable doubt. Here we go, 


Ly there are four elements: 


18 First, the government must prove that in connection 


19 with the purchase or sale of one of the securities -—- of 


01:56 20 securities specified in Count Four -—- I'm sorry. 


21 First, that in connection with the purchase or sale of 


22 fF the securities specified in Count Four. 


23 Second, the defendant employed any manipulative or 


24 deceptive device or contrivance; any device, scheme or artit 


25 to defraud; or engaged in any act, practice, or course of 


01:57 10 
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business that operated, or would operate, as a fraud or deceit 


upon a purchaser or 


seller of the specified security. Second, 


that the defendant employed any manipulative or deceptive 


device or contrivance or any device, scheme or artifice to 


defraud, or engaged 


in an act, practice, or course of business 


that operated, or would operate, as a fraud or deceit upon a 


purchaser or seller 


of the specified security. 


Third, that the defendant acted willfully, knowingly, 


and with the intent 


to defraud. Third, that the defendant 


acted willfully, knowingly, and with the intent to defraud. 


Fourth, that the defendant used, or caused to be used, 


any means or instruments of transportation or communication in 


interstate commerce, 


national securities 


or used the mails, or any facility of any 


exchange, in furtherance of the fraudulent 


conduct. Fourth, that the defendant used, or caused to be 


used, any means or instruments of transportation or 


communication in interstate commerce, or used the mails, or any 


£ 


facility o 


01:58 20 


21 


22 


23 


24 


25 


any national securities exchange in furtherance of 


the fraudulent conduct. 


Now, let me go through the elements in greater detail. 


The first element of the offense requires the government to 


prove beyond a reasonable doubt that the alleged device, 


scheme, or artifice 


purchase or sal 


Fraudulent 


to defraud be in connection with the 


the security. 


conduct may be in connection with the 
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i purchase or sale of a security if you find that the alleged 


2 fraudulent conduct in some way touched upon a securities 
3 transaction. 
4 Second, the second element of the securities fraud 


5 that the government must establish beyond a reasonable doubt is 


6 that in connection with the purchase or sale of securities, the 
7 defendant did any one of the following things: 


- 


8 One, employed a device, scheme, or artifice to 


9 defraud, or made any untrue statement of a material fact, or 
01:59 10 omitted to state a material fact necessary in order to make the 
11 statements made, in light of the circumstances under which they 
12 were made, not misleading; or engaged in an act, practice, or 
13 course of business that operated, or would operate, as a fraud 


14 or deceit upon the purchaser or seller. 


15 It is not necessary for the government to establish 


£ 


16 all three types o 


unlawful conduct. Any one is sufficient for 


£ 


17 a conviction, if you so find, but you must be unanimous as to 


18 which type of conduct the defendant engaged in. 


£ 


19 A device, scheme, or artifice to defraud means the 


01:59 20 forming of some plan or design to trick or to deceive in order 


21 to obtain money or something of value. The words "fraud" or 
22 "defrauding" means to trick, deceive, injure, or damage in some 


23 way. "Fraud" is a general term embracing all efforts and 


£ 


24 methods people use to take advantage of others. 


25 If you find that the scheme involved the defendant or 
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1 another participant in the scheme misrepresenting his or her 


2 identity online to access computer systems to obtain material 


3 nonpublic information to trade on the confidential information, 


4 then you may find that conduct is a deceptive device or 


5 contrivance, or a device, scheme or artifice to defraud within 


6 the meaning of the securities fraud statute. 
7 The government must prove the nonpublic information 


8 accessed is material. A fact is material if it has a natural 


£ 


9 tendency to influence, or is capable o 


influencing, the 


02:00 10 decision-maker to whom it is addressed. 


£ 


11 A statement, claim or document is fraudulent if it was 


12 false when it was made, or if it was made with reckless 


13 indifference as to its truth or falsity, and made or caused to 


14 be made with intent to deceive. A deceitful statement of 


£ 


15 half-truths or the concealment of material acts may also 


16 constitute fraud under the statute, if such omission or 


17 concealment was intended to be misleading. 


18 The government need not prove that the defendant 


19 personally made a misrepresentation or that he omitted a 


02:01 20 material fact. It is sufficient if the government establishes 


21 that the defendant caused the statement to be made or the fact 


22 to be omitted. 


23 [f you find that the government has established beyond 


24 a reasonable doubt that a statement was false or fact 


25 fraudulently omitted, you must next determine whether the fact 


02:02 10 
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as material under the circumstances. 


I've defined, for you, the word "material." 


It does not matter whether the alleged unlawful 


conduct was successful or not, or whether the defendant 


profited 
scheme. 


that the 


defraude 


such as 


charged. 


benefit 


or received any benefits as a result of the alleged 


Similarly, the government is not required to prove 


victim or victims of the fraud were actually 


d. It is enough to prove that the defendant engaged in 
cheme to defraud. 


£ 


Success or a benefit is not an element of the crime 


£ 


However, if you find the defendant did expect to 


from the alleged scheme, you may consider that in 


relation 


02:02 20 


21 


22 


23 


24 


25 


with you 


been tel 
and seco 


the exis 


to the third element, intent, which I will discuss 


in a moment. 


So the third element involves intent. Everything I've 


ling you thus far about Count Four relates to the first 


£ 


nd elements of the crime of securities fraud; that is, 


tence of a fraudulent scheme in connection with the 


purchase 


that the 


that the 


knowing] 


or sale of a security. 
The third element of the crime charged in Count Four 
government must prove beyond a reasonable doubt is 


defendant participated in a scheme to defraud 


y, willfully, and with the intent to defraud. As 


personal 


£ 


purposef 


ly noted, an act is done knowingly if it is done 


ully and deliberately and not because of a mistake, 
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al accident, mere negligence, or some other innocent reason. And 


ully if he acts deliberately and with the 


< 


2 a person acts will 


3 intent to do something wrong; that is, with a bad purpose to 


4 disobey and disregard the law. I told you that instruction 


bs) before. The defendant need not to have known that he was 


6 breaking any particular law or any particular rule. The 


7 defendant need only to have been aware of the generally 


8 unlawful nature of the acts. 


9 And, as I have noted, for the defendant to have acted 


02:03 10 with a specific intent to defraud means that he must have known 


1] of the fraudulent nature of the scheme and acted with the 


12 intent that it succeed. In other words, to act with an intent 


13 to defraud means to act knowingly and with a specific intent to 


14 deceive, ordinarily but not necessarily for the purpose of 


15 causing some loss to another person to bring some gain to 


16 himself. 
LS) The government is not required to show that the 


18 defendant, in addition to knowing what he was doing and 


19 deliberately doing it, also knew that he was violating some 


02:03 20 particular federal statute. However, he must have acted with 


21 the intent to help carry out some essential step in the 


22 execution of the scheme to defraud that is alleged in the 


23 indictment. 


24 The question of the defendant's intent is, again -—- 


25 I've discussed with you intent before it's a question of 


Case 1:21-cr-10104-PBS Document 218 Filed 02/21/23 Page 133 of 153 
10-133 


i fact that you are called upon to decide, just as you determine 


2 any other fact in the case. Intent to defraud involves the 


3 state of a person's mind and the purpose with which he acted at 


4 the time the acts in question occurred. Direct proof of 


5 knowledge and fraudulent intent is rarely available, and you 


£ ££ 


6 are not required to find that such proof existed. It would be 


7 a rare case where it could be shown that a person wrote or 


8 stated that as of a given time in the past he committed an act 


9 with fraudulent intent. Such direct proof is not required. 


02:04 10 The ultimate facts and knowledge and criminal intent, 


‘lal though subjective, may be established by circumstantial 


12 evidence based upon a person's outward manifestations, his 


13 words, his conduct, his acts, and all of the surrounding 


14 circumstances disclosed by the evidence and the rational or 


15 logical inferences that may have been drawn from them. 


16 Circumstantial evidence, if believed, is of no less value than 


17 irect evidence. 


18 Since an essential element of the crime charged is 


19 intent to defraud, it follows that the government must prove a 


02:05 20 lack of good faith on the part of the defendant. I've talked 


21 to you about good faith before. It is for you to decide 


22 whether the defendant acted in good faith or not. If you 


23 decide that he at all relevant times acted in good faith, it is 


24 your duty to acquit him. That is because, however misleading 


25 or deceptive conduct may have been, the law is not violated if 
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1 the defendant acted in good faith and held an honest belief 


2 that his actions were proper and not in furtherance of any 


3 illegal venture. 


4 [f you find that the defendant was not a knowing 


5 participant in the scheme, or lacked the intent to deceive, you 


6 must acquit him. Conversely, if you find that the government 


7 has established beyond a reasonable doubt not only the first 


8 two elements of Count Four -- that is, the existence of a 


9 scheme to defraud in connection with the purchase and sale of a 


02:06 10 security -—- but also this third element, that the defendant was 


ala a knowing participant and acted with intent to defraud, then 


12 you would move on to the fourth element which I'm about to 


13 discuss. If the government establishes the fourth element as 


14 well, then you would have a sufficient basis upon which to 


15 convict the defendant on Count Four of the indictment. 


16 So now I'm discussing the fourth element of the fourth 


ay count. The fourth and final element that the government must 


18 prove beyond a reasonable doubt with respect to Count Four is 


19 that the defendant knowingly used, or caused to be used, 


02:06 20 either, A, any instrumentalities in interstate commerce, or, B, 


21 a facility of a national securities exchange in furtherance of 


22 the scheme to defraud. 


23 The term "instrumentalities" in interstate commerce 


24 means any number of instruments, devices, and means of 


25 conducting trade, commerce, transportation, or communication 
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ac among one or more states, including interstate wire 


2 communications such as telephone calls, emails, faxes, and the 


3 use of computers connected to the Internet. Instrumentalities 


4 f interstate commerce include the use purely within one state 


bs ; telephone call, email, fax, or a computer connected to 1 


6 Internet, or any other instrument used to conduct interstate 


7 communication. 


8 The government need not prove that the defendant was 


9 directly or personally involved in using an instrumentality of 


02:07 10 interstate commerce or a facility of a national securities 


£ 


lal exchange. It is enough if you find that he, by his actions, 


12 directly or indirectly initiated steps or induced others to 


13 initiate steps that resulted in a chain of cause and effect 


14 resulting in the use of an instrumentality of interstate 


15 commerce. This use could mean something like placing a 


16 telephone call, sending an email, or using a computer connected 


Ly to the Internet. 


18 With regard to using instrumentalities of interstate 


19 commerce like phone calls, emails, or computers connected to 


02:08 20 the Internet, it is not necessary that whatever was 


21 communicated was fraudulent, otherwise criminal, or 


22 objectionable. The matter communicated may be entirely 
23 innocent so long as it is in furtherance of the scheme to 


24 defraud. 


25 The use of any instrumentality of interstate commerce 
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1 also need not be central to the execution of the scheme. All 


2 that is required is that the use of any instrumentality of 


3 interstate commerce bear some relation to the object of the 


4 scheme or fraudulent conduct. 


5 So I've now gone through all the elements of all 


6 counts, but let's stand and stretch because I've got to talk to 


i you about venue, all right? 


8 (Pause.) 


9 THE COURT: Venue, what's venue? Please be seated. 


02:10 10 The Constitution and federal law require that a criminal 


11 defendant must be tried in the state or district in which the 


12 offense is committed. Where an offense spans multiple 


13 jurisdictions or where a crime consists of distinct parts which 


14 have different localities, the whole may be tried where any 


15 part can be proved to have been done. Continuing offenses that 
16 are committed in more than one district may be prosecuted in 
17 any district which such offense was begun, continued, or 


18 completed. A defendant must be charged in a district that has 


19 a meaningful connection to the allegations. To determine 

02:11 20 whether a meaningful connection exists, you must consider the 
21 nature of the crime alleged and identify the crime's essential 
22 conduct elements, essential conduct elements. You must also 


23 consider the locations where the criminal acts were committed. 


24 The government must prove for each offense so each one of 


25 those counts we just went through -- that venue is proper in 


02:12 10 
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District of Massachusetts. 


Unlike all of the other elements that we talked 


about -- remember I said "proof beyond a reasonable doubt" 


numerous times -—-— but unlike all the elements that I previously 


described, the government has to prove venue by a preponderance 


of the 


evidence. That's a legal term, "preponderance of the 


evidence." That means, to establish venue by a preponderanc 


of the 


evidence, the government must prove that the fact is 


more likely true than not true, more likely true than not true. 


To establish venue in this district, the government 


need not prove that the crimes themselves were committed 


entirely in this district, or that the defendant himself was 


present here. 


I'm now going to focus you on conspiracy. 


With regard to the conspiracy charged in Count One, 


there's no requirement that the entire conspiracy took place 


here in Massachusetts, or that the agreement was formed here. 


02:12 20 


21 


22 


23 


24 


25 


in Count One, the government must prove by a preponderance of 


the evi 


But for you to return a guilty verdict on the conspiracy charge 


idence that any overt act in furtherance of the agreement 


took pl 


the conspiracy count with respect to what I'm about to tell 


lace here in Massachusetts. 


Alternatively -- now, I just want you to focus only on 


you. Alternatively, with respect to the conspiracy count only, 


the government has this alternative theory of venue. Under 
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1 federal law, where an offense is begun or committed outside the 


2 jurisdiction of any particular state or district, venue for 


3 prosecution of the offense is established in the district where 


4 the defendant is arrested or is first brought. For venue to be 


5 established for the conspiracy count under this alternative 


6 theory, the government must prove that it is more likely true 


- than not true that the offense was begun or committed outside 


8 of the United States, and that the defendant was first brought 


9 to the District of Massachusetts. The government must also 


02:13 10 prove that the essential conduct elements of the conspiracy 


‘lal took place outside of the United States. 


12 If the government fails to prove venue by a 


13 preponderance of the evidence with respect to any count, you 


14 must find the defendant not guilty of that count only. So for 


LS every single one of these verdict slips, you also have to find 


16 not only that the government proved the elements beyond a 


Ay reasonable doubt, but also that it proved venue by a 


18 preponderance of the evidence, more likely true than not true. 


19 I am now at the end of the middle section of this 


02:14 20 charge. The hard part has been completed, and now I want to 


21 talk to you about the mechanics of deliberation. 


22 Okay, so let me talk to you about going back into that 


23 jury room. The first thing that you should do upon going to 


24 the jury room is to choose a foreperson. When I was a brand- 


25 new young judge, which I no longer am, I used to look at you 
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1 all and try to figure out who would be the best foreperson, but 


2 you all have been together for a long time now, two weeks, and 


3 you know better than I do about who would make a good 

4 foreperson. So the first thing that you should do when you go 
5 back there is to choose a foreperson. 

6 The foreperson is not more equal than the rest. You 
7 heard them say it. The government said, "We're content with 

8 this jury." The defendant said, "We're content with this 

9 jury." You are all equal back there in the jury room. 


- 


02:15 10 However, the foreperson has certain responsibilities to me. 


11 First of all, the foreperson must fill in the verdict 


12 slip. I only want one. I don't need twelve floating around, 


13 one official verdict slip. And the foreperson will count and 


14 ill insure that it's unanimous. It must be unanimous "not 


15 lty," unanimous "guilty." It's got to be unanimous either 


17 The second thing that the foreperson does will be to 


18 ask me questions. I've given you a lot really quickly. You'll 


19 be getting a tape recording; you'll be getting a transcript. 


02:16 20 But it may be that you have questions about the law and it 


21 would be helpful for me to clarify. 


22 So the foreperson should —- Maryellen will give you a 


23 piece of paper. Oh, jury question. You'll write down what the 


fe hon 


icer, who will give it 


24 question is and give it to the court o 


25 to Maryellen. All the lawyers and I will huddle and try and 
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1 answer that question. But it's not like it will come back like 


2 that, like an ATM machine, because sometimes it takes a while 


3 for all of us to gather and come up with the right answer. So 


4 the foreperson will write down the question. 
5 The foreperson shouldn't just ask the court officer, 


6 or ask Maryellen, or ask the court reporter, because then it's 


£ 


. like a game of telephone; I don't really exactly get what you 


8 want. It's better for you to write it down. 


9 The third thing the foreperson does will be to 
02:17 10 announce the verdict in court. You'll hear us say, "So say 
11 you, Mr. Foreperson? So say you, Madam Foreperson? So say 


12 you, all members of the jury?" All of you have to stand and 


13 ratify that it is a unanimous verdict. 


14 The foreperson should never ask me what my memory of 


15 the evidence is. I took, really, notes, sometimes on some days 


16 better than others. Maybe some of you did; some of you didn't. 


A} I can't tell you what so-and-so said on such and such a day. 


18 You should use your collective memory, your collective notes. 


19 If you get really stuck and you want the transcript, we can do 


02:17 20 that, but it sometimes takes a while and might hold up the 


21 deliberations. So please use your notes and your memory first. 


22 If you need it, we can get it to you. All right? So that's 
23 what's going on there. 
24 We're going to bring in exhibits into the jury room in 


25 a couple of minutes. The exhibits are paper and a computer so 
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i that you can do it both ways, and we will bring those in. And 


2 I hope we get everything to you. We're going to go through 


3 them right after we send you out with all the lawyers to make 


4 sure we get you everything. 


5 Now let me discuss for a minute the role of the 


6 alternates. I've never been a juror in a case. I've been 


- called, but I've never been a juror. But I'm sure if I sat 


8 through this whole trial, I would have really not liked the 


9 fact that I was an alternate. But that is the way our system 


02:18 10 works. The last four jurors chosen are alternates, and so 


11 today you go home, but I am going to ask you not to do any 


12 research about the case or talk about the case until a verdict 


13 is reached. You can call in and check. The reason I say that 


14 I'm really impressed with this jury, I have to say, and 


15 I've been doing juries throughout COVID, and we always lost -- 


16 it sounds like a terrible example -- we've always had a few 


17 people who couldn't continue deliberating for one reason or 


18 another, and also there are snowstorms and no school and all 


19 that. You stuck with it all the way through. But we chose 


02:19 20 alternates if somebody were not able to continue. We may need 


21 to call you in if over the weekend I hope this doesn't 


22 happen -—- something happens. So we may still need to call in 


23 the alternates, so please don't discuss the case. 


24 We will be sitting on every day or days from 9:00 to 


25 4:00 until you reach a verdict. You have your room for as long 
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A as you want it. We will feed you, treat you with TLC, and it's 


2 not in any way designed to rush you at all. Today we were 


3 thinking that it might be a bit of a tiring day. We were 


4 thinking we'd leave at 4:00, and every day we'll leave at 4:00. 


5 And the last and final thing I really want to talk to 


6 you about is deliberating. 


- As I mentioned, I've never been chosen for a jury, but 


8 I always been impressed with my juries. You know, I get 


9 excited talking about my juries. I'm always impressed 


02:20 10 how seriously you all take your task. I mean, everything 
11 so far has been spot on. 


12 When you go back there, everyone has a sense of what's 


13 fair and just, what witnesses you believe, what witnesses 


14 didn't you believe. Everyone goes back there with their sense 


15 of what they think about this case. But the beauty of 


16 deliberations is, you need to stay open-minded to hear what 


Ls} other people from other walks of life with different experi 


£ 


18 also think about the evidence. So 


eel free, and you must, 


19 be open to changing your mind if there's a good reason for 
02:21 20 doing that, if someone has a good point and someone has more 
21 experience. 


22 On the other hand, no one should change their mind 


23 because you've been here long enough, you're ready for spring, 
24 it's Valentine's Day. Whatever reason it is, no one should 


25 change their mind unless you've got a principled basis for 
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i doing it, because at the end of this, I am going to ask you to 


2 stand up and agree with that verdict. So change your mind if 


3 there's a reasoned basis for doing so, but don't change it just 
4 because you disagree with other people, all right? So make 


5 sure you own it essentially. 


6 I need to talk to the attorneys for a few minutes 


7 about any objections that they may have. I think I'll send you 


8 back there to start talking. The four alternates should take 


9 their things and leave. I may have to call you back in here if 


02:22 10 the attorneys have any points that I need to address. There's 


11 a lot in there. Maybe I misread something or they think 


12 something is necessary to clarify something, but I think I'm 


13 going to send you out there, and then I may call you back ina 


14 few minutes. But otherwise, I'll call you back in here at 4:00 


15 if I don't need to see you again. 


16 So the four alternates at this point should just 


LS) leave, I think. So let me ask -- actually, let me ask the 


18 lawyers, is there anything quick that you need to see me about 


19 right now? 


02:22 20 MR. FERNICH: Can you just instruct the alternates not 


21 to do any research or look at social media. 


22 THE COURT: Good point. The alternates shouldn't look 


23 anything up on social media or the Internet, or whatever, about 


£ 


24 the case because I might need you if someone isn't able to come 


25 in on Monday. Okay. Okay? Other than that, no one needs to 


Case 1:21-cr-10104-PBS Document 218 Filed 02/21/23 Page 144 of 153 


10-144 


1 see me right now? Good. All right, see you at 4:00. 


2 (Jury excused.) 


3 THE COURT: I'll see counsel at sidebar just fora 


4 inute. 


5 ‘BAR CONFERENCE: 


6 THE COURT: Let me start off by saying, we had an 


7 extremely brief discussion after the closings about sending in 


8 the indictment, and I didn't quite focus on how many times I 


9 mentioned the indictment. I think I need to send it in. 


02:24 10 MR. FRANK: I agree. 


11 THE COURT: I don't think it harms you. I just -- 


12 don't see how else the whole set of instructions mentions 


13 the indictment. I think I need to do that. 


14 The government, any objections? 
15 MR. FRANK: No, your Honor. 


16 COURT: Defense? 


17 MR. FERNICH: None beyond formally reiterating all of 


18 those previously lodged. 


19 THE COURT: You can't do that broadly. You mean the 


02:24 20 f filed in writing? 


AL MR. FE CH: Yes, that, Judge, sure. 


22 I fixed a fair amount of those, so 


23 


24 MR. FE : I need to discuss it for the record 


25 exactly what 
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1 THE COURT: I don't want to tell you how to do your 


2| job, but -- 


3 MR. FERNICH: All objections previously filed with 


4 particular reference to venue and 3283, the high seas venue 


5 statute in particular. 


6 THE COURT: Okay, okay. 


7 MR. FERNICH: Those are the main ones. And, of 


8 course, we object to the charging on the Khalupsky/Dorozkho 


9 theory. That was a big one. 


02:25 10 Is there anything else? 
11 MR. NEMTSEV: No. 


12 MR. FERNICH: I think those are the most major ones. 


13 THE COURT: The alternative theory of venue. 


14 MR. FERNICH: Yes. 


15 THE COURT: Dorozkho. 


16 MR. FERNICH: 


Ly THE COURT: I can't remember. 


18 MR. FERNICH: Lt, 


19 THE COURT: 


02:26 20 THE CLERK: need to go over and put on the 
21 record --— 


22 THE COURT: You need to put on the record that you're 


23 content with the exhibits. 
24 For the U.S. Marshals, we need him back here at 4:00, 


25 okay? All right, thank you. 


Case 1:21-cr-10104-PBS Document 218 Filed 02/21/23 Page 146 of 153 
10-146 


1 : Just need to know if the government is 
2 content. 


3 3 : We are content. 


4 ] : So that's on the record. 


5 : : Regarding the exhibits? 


6 1 : Regarding the exhibits. 


7 7 : Yes. 


8 : [CH: Let me see if there's anything glaring 


9 ft out. 
02:26 10 THE Mr. Nemtsev, are you happy with the 


11 exhibits? 


12 MR. NEMTSEV: Yes. 


13 THE COURT: And can I be clear that the laptop is not 


14 going -- it doesn't go outside here? It just has documents on 


15 it, right? It's not Internet-connected? 


16 MR. FERNICH: It's like a jail laptop, you know? Two 


LS) seconds, okay? I'll get there fast. 


18 THE COURT: Of course. 


19 MR. KOSTO: The laptop was erased in its entirety, and 


02:27 20 then the exhibits were saved to it electronically, so that's 


21 all that is on the laptop. 


22 MR. FERNICH: Yeah, I think I said specifically on the 


23 venue stuff, the reasonable foreseeability charge, the absenc 
24 of that. 


25 THE COURT: Yes. 
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1 MR. FERNICH: And particularly all the written 


2 instructions that I submitted in the last three days with 


3 regard to venue, I would say I incorporate all that by 


4 reference, in addition to the things I said five minutes ago. 


5 THE COURT: Okay, thank you. 


6 MR. FERNICH: You're welcome. 


7 THE COURT: I'm glad you caught the foreseeability. 


8 MR. FERNICH: Yes, I think you got it by saying 


9 everything that I submitted in writing, but the writings of the 


02:28 10 last two and three days will suffice. 


11 THE COURT: Okay, thank you. 


12 End of sidebar conference.) 


13 HE COURT: Okay, so we'll see you back here at 4:00? 


14 Although I do need Mr. Nemtsev to —-- 


15 MR. NEMTSEV: We're satisfied with the exhibits. 


16 THE COURT: And in particular, since I may not be 


17 seeing you again on this, I want to thank very much; one, the 


18 paralegals for making this very smooth with a lot of documents; 


19 and, second, counsel, because this could have been very 


02:29 20 tedious, and I actually think it went very smoothly. 


21 MR. FERNICH: A pleasure to try the case be! 


22 Thank you. 


the record.) 


23 (Discussion o 


24 THE COURT: All right, here's the indictment, 


25 everyone. 
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1 THE CLERK: Make sure there's nothing else attached to 


2 that. I get nervous about —-- okay. Got it. Thank you. So 


3 this is going back in. Do you want this marked as something or 
4 just the indictment? 

5 MR. KOSTO: We're okay with it as is. 

6 (A recess was taken, 2:30 p.m.) 


7 (Resumed, 3:23 p.m.) 


8 THE COURT: I received a question from the jury 
9 foreman: "All three defendants --" 


03:23 10 You know what? He isn't here. 


11 MR. FERNICH: We waive his presence for this. Sorry 


12 about that. 


13 THE COURT: "All three defendants, Klyushin, Ermakov 


14 and Rumiantcev, does the verdict apply to each defendant or 


LS just Mr. Klyushin?" 


16 I think I just say "Just Mr. Klyushin." 


17 MR. FRANK: Judge, we had asked for an instruction on 


18 other individuals not on trial. We think it's appropriate in 


19 this circumstance. It's a little more than what you just said. 


03:23 20 It says, "Some of the people who may have been involved in 
21 these events are not on trial. This does not matter. There's 


22 no requirement that all participants in a crime should be 


23 charged and prosecuted or tried together in one proceeding. 


£ 


24 You may not draw any inference, favorable or unfavorable, 


25 towards the government or the defendant from the fact that 
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alt those individuals are not on trial. Your task is limited to 


2 considering the charges contained in the indictment and the 


3 defendant before you." 


4 MR. NEMTSEV: think it's so long, we can just say 


5 deciding concerning Mr. Klyushin. 


6 THE COURT: I'm going to say "Just Mr. Klyushin." 


7 MR. FRANK: I think that the question suggests some 


8 confusion on their part about why there are other defendants 


9 named. 


03:24 10 THE COURT: It's obvious to us because I read a whole 


11 charge involving Mr. Klyushin, but all three are named, so I 


12 think that's the confusion. 
13 MR. FRANK: Exactly, which is why -- 


14 MR. FERNICH: And the indictment with all three 


15 defendants on it. 


16 MR. FRANK: Which is why I think that telling them 


Ly that the others 


18 THE COURT: I'm going to say, "The verdict only 


19 applies to Mr. Klyushin." 
03:25 20 (Pause.) 


21 THE COURT: I said, "The verdict only applies to 


22 Mr. Klyushin." Okay. I mean, I don't want him to be found 


23 guilty based on the others. I mean, if they find that Ermakov 
24 and Rumiantcev are guilty, they can't -- 


25 MR. FRANK: That's why we think the -- 


03:26 10 
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MR. KOSTO: We're asking that they be instructed that 


two individuals. 


THE COURT: Well, 


they shouldn't be deliberating at all, either way, as to those 


think they're all relevant. Once 


they get into it, then they have to I mean, we included it 


in the indictment we sent in, we included it in the verdict 


form, but I think they need to understand —-— 


Yes, just run it in. 


THE CLERK: And then we can meet -—- should I 


follow-up comes out or no? 


THE COURT: No. Send them home. I'm tired. 


THE CLERK: Would you like a copy of this? She put it 


on the record what she wrote. I'm just going to give it back 


to them, and then I'll have 


read it, and then I'll give 


03:43 20 


21 


22 


23 


24 


25 


Al give it back to me after they 


it to you. So don't go too far. 


(A recess was taken, 3:26 p.m.) 


(Resumed, 3:43 p.m.) 


THE COURT: I understand that Mr. Klyushin isn't here, 


MR. FERNICH: Yeah, we waive. We waive. 


THE COURT: -—-- the thought occurred to me upstairs, 


just to clarify this thing by just putting only Mr. Klyushin's 


name on the verdict form. 


It never occurred to me they would 


think otherwise, but I think this will just make it crystal 


clear, and I'll hand it to them when I send them out. Does 


03:44 10 


03:53 20 


21 


22 


23 


24 


25 
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that seem like an appropriate solution to you? 


MR. FRANK: 


MR. NEMTSE 


THE COURT: 


Yes. Yes, your Honor. 


iV: Yes, absolutely. 


Okay, so we will wait until -- I'm not 


going to bring them out now. I'll bring them out in a few 


minutes. As 


everyone can 


Are 


soon as he gets up here, we'll send them home, 
have a long weekend and relax. 


you going home? 


MR. FERNICH: No. We're going to go to the Bruins 


game tomorrow. 


T 
dealing wit 


( 


HE COURT: 


Discussion o 


thought this was a crystal-clear way 


th the question. 


the record.) 


(A recess was taken, 3:44 p.m.) 


(Resumed, 


THE CLERK: 


3:51 p.m.) 


All rise for the jury. 


(Jury enters the courtroom.) 


THE COURT: 


take ten seconds. 


Okay, please remain standing. This will 


I'm going to send you home for the day. I 


remind you not to talk about this case with anybody. It's 


almost going to become irresistible. They're going to say, 


"What's it 


about? 


What's going on? Just don't talk to anyone, 


and I'll ask you about that Monday morning. 


When you come in Monday morning, don't start 


deliberating until 


all -- I'm going to bring you in Monday 
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1 morning -—- till I count to twelve, you know, that everybody is 


2 here, so please don't start deliberating until I send you out 


3 in the morning. 


4 Now, you asked a very good question which I clarified 


bs in an answer, but to make it crystal clear, I have a verdict 


6 form that just mentions his name so that there's nothing left 


7 that's confusing. So basically the verdict is only with 


8 respect to Mr. Klyushin. 


9 Okay, I think that's it, and I'll see you Monday 


03:54 10 morning. Have a lovely weekend. 

11 Would you give that to them, Clary. Okay. 

12 No, no, not copies. Just one, that's fine. Just give 
13 it to the Foreperson. Good-night. 

14 (Jury excused.) 


15 THE COURT: And I ask you, do you want to be here 


16 Monday morning when I send them out? I do make it a practice 


17 to count, make sure there are twelve, and send them out, and 


18 make sure no one has spoken about the case. 


19 MR. NEMTSEV: Yes, Judge. 


03:55 20 THE COURT: I only care that fF you are here or 


21 none of you are here. 


22 MR. NEMTSEV: We'll be here. 


23 MR. FRANK: We'll be here. 


24 THE COURT: Good. 


25 So please tell them I want Mr. Klyushin here in the 
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morning at 9:00. Okay, thank you very much. See you all then. 


You deserve a nice restful weekend. 


(Adjourned, 3:56 p.m.) 
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